Re-fixed #70895

NEWS

@@ -4,7 +4,7 @@ PHP                                                                        NEWS
 
 - Core:
   . Fixed bug #70895 (null ptr deref and segfault with crafted calable).
-    (Anatol)
+    (Anatol, Laruence)
 
 - Streams/Socket
   . Add IPV6_V6ONLY constant / make it usable in stream contexts. (Bob)

Zend/tests/bug70895.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #70895 null ptr deref and segfault with crafted calable
+--FILE--
+<?php
+
+array_map("%n", 0);
+array_map("%n %i", 0);
+array_map("%n %i aoeu %f aoeu %p", 0);
+?>
+--EXPECTREGEX--
+Warning: array_map\(\) expects parameter 1 to be a valid callback, function '%n' not found or invalid function name in .+
+
+Warning: array_map\(\) expects parameter 1 to be a valid callback, function '%n %i' not found or invalid function name in .+
+
+Warning: array_map\(\) expects parameter 1 to be a valid callback, function '%n %i aoeu %f aoeu %p' not found or invalid function name in .+bug70895.php on line \d+

Zend/zend.c

@@ -1346,7 +1346,7 @@ ZEND_API ZEND_COLD void zend_internal_type_error(zend_bool throw_exception, cons
 	if (throw_exception) {
 		zend_throw_exception(zend_ce_type_error, message, 0);
 	} else {
-		zend_error(E_WARNING, message);
+		zend_error(E_WARNING, "%s", message);
 	}
 	efree(message);