- MFH Fixed Bug #37667 (Object is not added into array returned by __get)

diff --git a/Zend/tests/bug37667.phpt b/Zend/tests/bug37667.phpt
new file mode 100755 (executable)
index 0000000..429a9be
--- /dev/null
+++ b/Zend/tests/bug37667.phpt
@@ -0,0 +1,43 @@
+--TEST--
+Bug #37667 (Object is not added into array returned by __get)
+--FILE--
+<?php
+
+class Test
+{
+       protected $property = array('foo' => 'bar');
+
+       function __get($name)
+       {
+               return $this->property;
+       }
+}
+
+$obj = new Test;
+
+var_dump($obj->property['foo']);
+var_dump($obj->property[2]);
+
+var_dump($obj);
+
+$obj->property[] = 1;
+$obj->property[] = 2;
+
+var_dump($obj);
+
+?>
+===DONE===
+--EXPECTF--
+string(3) "bar"
+
+Notice: Undefined offset:  2 in %sbug37667.php on line %d
+NULL
+object(Test)#%d (1) {
+  ["property:protected"]=>
+  array(1) {
+    ["foo"]=>
+    string(3) "bar"
+  }
+}
+
+Fatal error: Cannot use array returned from Test::__get('property') in write context in %sbug37667.php on line %d

diff --git a/Zend/zend_exceptions.c b/Zend/zend_exceptions.c
index 6a7cf43bd55da4ce6b4e129386dab0edaad2188d..84d143260137f0bcc9d724de247c3c2b833e84c5 100644 (file)
--- a/Zend/zend_exceptions.c
+++ b/Zend/zend_exceptions.c
@@ -435,7 +435,7 @@ ZEND_METHOD(exception, getTraceAsString)
        char *res = estrdup(""), **str = &res, *s_tmp;
        int res_len = 0, *len = &res_len, num = 0;
 
-       trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
+       trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, BP_VAR_R TSRMLS_CC);
        zend_hash_apply_with_arguments(Z_ARRVAL_P(trace), (apply_func_args_t)_build_trace_string, 3, str, len, &num);
 
        s_tmp = emalloc(1 + MAX_LENGTH_OF_LONG + 7 + 1);

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 99fb7ac7adc211410a40a346d08373b0a1be917e..9a05235f143380bdfdc9d031c2b2dbd861912dee 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -946,6 +946,7 @@ static inline zval **zend_fetch_dimension_address_inner(HashTable *ht, zval *dim
                        offset_key = "";
                        offset_key_length = 0;
                        goto fetch_string_dim;
+
                case IS_STRING:
                        
                        offset_key = dim->value.str.val;
@@ -1266,7 +1267,7 @@ static void zend_fetch_property_address(temp_variable *result, zval **container_
                        zval *ptr;
 
                        if (Z_OBJ_HT_P(container)->read_property &&
-                               (ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, BP_VAR_W TSRMLS_CC)) != NULL) {
+                               (ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, type TSRMLS_CC)) != NULL) {
                                if (result) {
                                        result->var.ptr = ptr;
                                        result->var.ptr_ptr = &result->var.ptr;
@@ -1279,7 +1280,7 @@ static void zend_fetch_property_address(temp_variable *result, zval **container_
                }
        } else if (Z_OBJ_HT_P(container)->read_property) {
                if (result) {
-                       result->var.ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, BP_VAR_W TSRMLS_CC);
+                       result->var.ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, type TSRMLS_CC);
                        result->var.ptr_ptr = &result->var.ptr;
                }
        } else {

diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index f880d441ef9acb8fd9d3eadcdc9ee1407a4b17ad..d3a52064fe716c5723ac0a4431162b0ae3b91ec9 100644 (file)
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -349,6 +349,9 @@ zval *zend_std_read_property(zval *object, zval *member, int type TSRMLS_DC)
                zval_ptr_dtor(&tmp_member);
                (*retval)->refcount--;
        }
+       if (*retval && (type == BP_VAR_W || type == BP_VAR_RW) && Z_TYPE_PP(retval) == IS_ARRAY) {
+               zend_error(E_ERROR, "Cannot use array returned from %s::__get('%s') in write context", zobj->ce->name, Z_STRVAL_P(member));
+       }
        return *retval;
 }