Skip to content

Commit 7157f48

Browse files
committed
Fix GH-20286: use-after-destroy during userland stream_close().
1 parent 6fe40de commit 7157f48

File tree

1 file changed

+18
-13
lines changed

1 file changed

+18
-13
lines changed

Zend/zend_execute_API.c

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1077,22 +1077,27 @@ ZEND_API zend_result zend_call_method_if_exists(
10771077
zend_object *object, zend_string *method_name, zval *retval,
10781078
uint32_t param_count, zval *params)
10791079
{
1080-
zend_fcall_info fci;
1081-
fci.size = sizeof(zend_fcall_info);
1082-
fci.object = object;
1083-
ZVAL_STR(&fci.function_name, method_name);
1084-
fci.retval = retval;
1085-
fci.param_count = param_count;
1086-
fci.params = params;
1087-
fci.named_params = NULL;
1080+
if (EG(active)) {
1081+
zend_fcall_info fci;
1082+
fci.size = sizeof(zend_fcall_info);
1083+
fci.object = object;
1084+
ZVAL_STR(&fci.function_name, method_name);
1085+
fci.retval = retval;
1086+
fci.param_count = param_count;
1087+
fci.params = params;
1088+
fci.named_params = NULL;
1089+
1090+
zend_fcall_info_cache fcc;
1091+
if (!zend_is_callable_ex(&fci.function_name, fci.object, IS_CALLABLE_SUPPRESS_DEPRECATIONS, NULL, &fcc, NULL)) {
1092+
ZVAL_UNDEF(retval);
1093+
return FAILURE;
1094+
}
10881095

1089-
zend_fcall_info_cache fcc;
1090-
if (!zend_is_callable_ex(&fci.function_name, fci.object, IS_CALLABLE_SUPPRESS_DEPRECATIONS, NULL, &fcc, NULL)) {
1091-
ZVAL_UNDEF(retval);
1096+
return zend_call_function(&fci, &fcc);
1097+
} else {
1098+
ZEND_UNREACHABLE();
10921099
return FAILURE;
10931100
}
1094-
1095-
return zend_call_function(&fci, &fcc);
10961101
}
10971102

10981103
/* 0-9 a-z A-Z _ \ 0x80-0xff */

0 commit comments

Comments
 (0)