- Fixed bug #61388 (ReflectionObject:getProperties() issues invalid reads

  when get_properties returns a hash table with (inaccessible) dynamic
  numeric properties).

diff --git a/NEWS b/NEWS
index 7f81598b169d9546b4b2852d103043592690cedc..7563155c76d562fba85c459c1df9859683a81dc8 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -72,6 +72,13 @@ PHP                                                                        NEWS
   . Fixed bug #61088 (Memory leak in readline_callback_handler_install).
     (Nikic, Laruence)
 
+- Reflection:
+  . Fixed bug #61388 (ReflectionObject:getProperties() issues invalid reads
+    when get_properties returns a hash table with (inaccessible) dynamic
+    numeric properties). (Gustavo)
+  . Fixed bug #60968 (Late static binding doesn't work with 
+    ReflectionMethod::invokeArgs()). (Laruence)
+
 - SOAP
   . Fixed basic HTTP authentication for WSDL sub requests. (Dmitry)
   . Fixed bug #60887 (SoapClient ignores user_agent option and sends no
@@ -90,10 +97,6 @@ PHP                                                                        NEWS
 - SQLite3 extension:
   . Add createCollation() method. (Brad Dewar)
 
-- Reflection:
-  . Fixed bug #60968 (Late static binding doesn't work with 
-    ReflectionMethod::invokeArgs()). (Laruence)
-
 - Session:
   . Fixed bug #60860 (session.save_handler=user without defined function core
     dumps). (Felipe)

diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index 06f806f289004edd4bff10565b3ff9c3f919d413..94cc05ee584bb91948ce99683ba92fd91bf26d5e 100644 (file)
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -3667,6 +3667,13 @@ static int _adddynproperty(zval **pptr TSRMLS_DC, int num_args, va_list args, ze
        zend_class_entry *ce = *va_arg(args, zend_class_entry**);
        zval *retval = va_arg(args, zval*), member;
 
+       /* under some circumstances, the properties hash table may contain numeric
+        * properties (e.g. when casting from array). This is a WONT FIX bug, at
+        * least for the moment. Ignore these */
+       if (hash_key->nKeyLength == 0) {
+               return 0;
+       }
+
        if (hash_key->arKey[0] == '\0') {
                return 0; /* non public cannot be dynamic */
        }

diff --git a/ext/reflection/tests/bug61388.phpt b/ext/reflection/tests/bug61388.phpt
new file mode 100644 (file)
index 0000000..75c0300
--- /dev/null
+++ b/ext/reflection/tests/bug61388.phpt
@@ -0,0 +1,32 @@
+--TEST--
+ReflectionObject:getProperties() issues invalid reads when it get_properties returns a hash table with (inaccessible) dynamic numeric properties
+--FILE--
+<?php
+$x = new ArrayObject();
+$x[0] = 'test string 2';
+$x['test'] = 'test string 3';
+$reflObj = new ReflectionObject($x);
+print_r($reflObj->getProperties(ReflectionProperty::IS_PUBLIC));
+
+$x = (object)array("a", "oo" => "b");
+$reflObj = new ReflectionObject($x);
+print_r($reflObj->getProperties(ReflectionProperty::IS_PUBLIC));
+--EXPECT--
+Array
+(
+    [0] => ReflectionProperty Object
+        (
+            [name] => test
+            [class] => ArrayObject
+        )
+
+)
+Array
+(
+    [0] => ReflectionProperty Object
+        (
+            [name] => oo
+            [class] => stdClass
+        )
+
+)