- Fixed bug #61388 (ReflectionObject:getProperties() issues invalid reads

  when get_properties returns a hash table with (inaccessible) dynamic
  numeric properties).

diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index b5ea8386c5ce067f18316f1819394f75e00a1b86..28184e1cc6ac6140bc01f96698f63d2535594d7e 100644 (file)
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -3832,6 +3832,13 @@ static int _adddynproperty(zval **pptr TSRMLS_DC, int num_args, va_list args, ze
        zend_class_entry *ce = *va_arg(args, zend_class_entry**);
        zval *retval = va_arg(args, zval*), member;
 
+       /* under some circumstances, the properties hash table may contain numeric
+        * properties (e.g. when casting from array). This is a WONT FIX bug, at
+        * least for the moment. Ignore these */
+       if (hash_key->nKeyLength == 0) {
+               return 0;
+       }
+
        if (hash_key->arKey[0] == '\0') {
                return 0; /* non public cannot be dynamic */
        }

diff --git a/ext/reflection/tests/bug61388.phpt b/ext/reflection/tests/bug61388.phpt
new file mode 100644 (file)
index 0000000..75c0300
--- /dev/null
+++ b/ext/reflection/tests/bug61388.phpt
@@ -0,0 +1,32 @@
+--TEST--
+ReflectionObject:getProperties() issues invalid reads when it get_properties returns a hash table with (inaccessible) dynamic numeric properties
+--FILE--
+<?php
+$x = new ArrayObject();
+$x[0] = 'test string 2';
+$x['test'] = 'test string 3';
+$reflObj = new ReflectionObject($x);
+print_r($reflObj->getProperties(ReflectionProperty::IS_PUBLIC));
+
+$x = (object)array("a", "oo" => "b");
+$reflObj = new ReflectionObject($x);
+print_r($reflObj->getProperties(ReflectionProperty::IS_PUBLIC));
+--EXPECT--
+Array
+(
+    [0] => ReflectionProperty Object
+        (
+            [name] => test
+            [class] => ArrayObject
+        )
+
+)
+Array
+(
+    [0] => ReflectionProperty Object
+        (
+            [name] => oo
+            [class] => stdClass
+        )
+
+)