From a1b7ccdfc69a1ad9938039f687ad7059ed1bd506 Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@zend.com>
Date: Thu, 11 Apr 2019 14:24:04 +0300
Subject: [PATCH] Fixed bug #77877 (call_user_func() passes $this to satatic
 methods).

---
 NEWS                     |  2 ++
 Zend/tests/bug77877.phpt | 23 +++++++++++++++++++++++
 Zend/zend_API.c          |  4 ++++
 3 files changed, 29 insertions(+)
 create mode 100644 Zend/tests/bug77877.phpt

diff --git a/NEWS b/NEWS
index 178b551273b..faa1c164b4f 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #77345 (Stack Overflow caused by circular reference in garbage
     collection). (Alexandru Patranescu, Nikita, Dmitry)
+  . Fixed bug #77877 (call_user_func() passes $this to satatic methods).
+    (Dmitry)
   . Implemented request #76148 (Add array_key_exists() to the list of
     specially compiled functions). (Majkl578)
   . Fixed bug #76430 (__METHOD__ inconsistent outside of method).
diff --git a/Zend/tests/bug77877.phpt b/Zend/tests/bug77877.phpt
new file mode 100644
index 00000000000..9e0181e1a6d
--- /dev/null
+++ b/Zend/tests/bug77877.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #77877 call_user_func() passes $this to satatic methods
+--FILE--
+<?php
+class Foo {
+	static public function bar() {
+		var_dump($this);
+	}
+}
+try {
+	array_map([new Foo, 'bar'],[1]);
+} catch (Throwable $e) {
+	echo $e->getMessage() . "\n";
+}
+try {
+	call_user_func([new Foo, 'bar']);
+} catch (Throwable $e) {
+	echo $e->getMessage() . "\n";
+}
+?>
+--EXPECT--
+Using $this when not in object context
+Using $this when not in object context
diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index 881ee27a031..20b5fbb3b47 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -3170,6 +3170,10 @@ get_function_via_handler:
 
 	if (fcc->object) {
 		fcc->called_scope = fcc->object->ce;
+		if (fcc->function_handler
+		 && fcc->function_handler->common.fn_flags & ZEND_ACC_STATIC) {
+			fcc->object = NULL;
+		}
 	}
 	return retval;
 }