- MFH: Fix bug #37212 (Access to protected property of common base class)

  By adding "zend_class_entry *ce" to struct zend_property_info;

diff --git a/Zend/tests/bug37212.phpt b/Zend/tests/bug37212.phpt
new file mode 100755 (executable)
index 0000000..5320a61
--- /dev/null
+++ b/Zend/tests/bug37212.phpt
@@ -0,0 +1,55 @@
+--TEST--
+Bug #3721 (Access to protected property of common base class)
+--FILE--
+<?php
+
+class A
+{
+    protected $value;
+
+    public function __construct($val)
+    {
+        $this->value = $val;
+    }
+
+    protected function getValue()
+    {
+        return $this->value;
+    }
+}
+
+class B extends A
+{
+    public function copyValue($obj)
+    {
+        $this->value = $obj->getValue();
+        $this->value = $obj->value; // value defined in common base class
+    }
+}
+class C extends A {}
+
+$B = new B("B");
+var_dump($B);
+$C = new C("C");
+var_dump($C);
+
+$B->copyValue($C);
+
+var_dump($B);
+
+?>
+===DONE===
+--EXPECTF--
+object(B)#%d (1) {
+  ["value:protected"]=>
+  string(1) "B"
+}
+object(C)#%d (1) {
+  ["value:protected"]=>
+  string(1) "C"
+}
+object(B)#%d (1) {
+  ["value:protected"]=>
+  string(1) "C"
+}
+===DONE===

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index 3c7f213c7185e0400714fd8cad60770bd0010764..caf613f020475b3dc06fe10d6fe7c13d6882079c 100644 (file)
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -2376,6 +2376,8 @@ ZEND_API int zend_declare_property_ex(zend_class_entry *ce, char *name, int name
 
        property_info.doc_comment = doc_comment;
        property_info.doc_comment_len = doc_comment_len;
+
+       property_info.ce = ce;
        
        zend_hash_update(&ce->properties_info, name, name_length + 1, &property_info, sizeof(zend_property_info), NULL);
 

diff --git a/Zend/zend_compile.h b/Zend/zend_compile.h
index d108d07517679d863e0a614f06770623dd3f9af1..d815579073f0bf3c597f41512d3b5a0e1db7931d 100644 (file)
--- a/Zend/zend_compile.h
+++ b/Zend/zend_compile.h
@@ -5,7 +5,7 @@
    | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
-   | that is bundled with this package in the file LICENSE, and is        | 
+   | that is bundled with this package in the file LICENSE, and is        |
    | available through the world-wide-web at the following url:           |
    | http://www.zend.com/license/2_00.txt.                                |
    | If you did not receive a copy of the Zend license and are unable to  |
@@ -149,6 +149,7 @@ typedef struct _zend_property_info {
        ulong h;
        char *doc_comment;
        int doc_comment_len;
+       zend_class_entry *ce;
 } zend_property_info;
 
 

diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index 5e2894a198406021fe2268e0c1d7c33c275d2730..bdcebd3d43e13f84cc18a0a88a919443a16843f6 100644 (file)
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -150,7 +150,7 @@ static int zend_verify_property_access(zend_property_info *property_info, zend_c
                case ZEND_ACC_PUBLIC:
                        return 1;
                case ZEND_ACC_PROTECTED:
-                       return zend_check_protected(ce, EG(scope));
+                       return zend_check_protected(property_info->ce, EG(scope));
                case ZEND_ACC_PRIVATE:
                        if (ce==EG(scope) && EG(scope)) {
                                return 1;
@@ -190,7 +190,7 @@ ZEND_API struct _zend_property_info *zend_get_property_info(zend_class_entry *ce
                                zend_error(E_ERROR, "Cannot access property started with '\\0'");
                        }
                }
-               return NULL;                            
+               return NULL;
        }
        h = zend_get_hash_value(Z_STRVAL_P(member), Z_STRLEN_P(member) + 1);
        if (zend_hash_quick_find(&ce->properties_info, Z_STRVAL_P(member), Z_STRLEN_P(member)+1, h, (void **) &property_info)==SUCCESS) {
@@ -238,6 +238,7 @@ ZEND_API struct _zend_property_info *zend_get_property_info(zend_class_entry *ce
                EG(std_property_info).name = Z_STRVAL_P(member);
                EG(std_property_info).name_length = Z_STRLEN_P(member);
                EG(std_property_info).h = h;
+               EG(std_property_info).ce = ce;
                property_info = &EG(std_property_info);
        }
        return property_info;
@@ -579,7 +580,7 @@ static void zend_std_unset_property(zval *object, zval *member TSRMLS_DC)
                    zend_get_property_guard(zobj, property_info, member, &guard) == SUCCESS &&
                    !guard->in_unset) {
                        /* have unseter - try with it! */
-                       guard->in_unset = 1; /* prevent circular setting */
+                       guard->in_unset = 1; /* prevent circular unsetting */
                        zend_std_call_unsetter(object, member TSRMLS_CC);
                        guard->in_unset = 0;
                }
@@ -842,6 +843,7 @@ ZEND_API zval **zend_std_get_static_property(zend_class_entry *ce, char *propert
                std_property_info.name = property_name;
                std_property_info.name_length = property_name_len;
                std_property_info.h = zend_get_hash_value(std_property_info.name, std_property_info.name_length+1);
+               std_property_info.ce = ce;
                property_info = &std_property_info;
        }