MFH

diff --git a/NEWS b/NEWS
index 50bd51052cf6f4a4a9a09f1c44658fb045fc0ddd..b04eda72b87b803192f99042504855aba4ccd249 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,8 @@ PHP                                                                        NEWS
 - Upgraded SQLite 3 to version 3.3.12 (Ilia)
 - Upgraded PCRE to version 7.0 (Nuno)
 - Add --ri switch to CLI which allows to check extension information. (Marcus)
+- Fixed bug #40431 (dynamic properties may cause crash in ReflectionProperty 
+  methods). (Tony)
 - Fixed bug #40410 (ext/posix does not compile on MacOS 10.3.9). (Tony)
 - Fixed bug #39836 (SplObjectStorage empty after unserialize). (Marcus)
 

diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index d47d680549976806f65079b02765dee61bdc729b..ac755ea61d97ab80bffbb054f09e204d9e015a72 100644 (file)
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -1142,14 +1142,19 @@ static void reflection_property_factory(zend_class_entry *ce, zend_property_info
 
        if (!(prop->flags & ZEND_ACC_PRIVATE)) {
                /* we have to search the class hierarchy for this (implicit) public or protected property */
-               zend_class_entry *tmp_ce = ce;
-               zend_property_info *tmp_info;
-               
+               zend_class_entry *tmp_ce = ce, *store_ce = ce;
+               zend_property_info *tmp_info = NULL;
+
                while (tmp_ce && zend_hash_find(&tmp_ce->properties_info, prop_name, strlen(prop_name) + 1, (void **) &tmp_info) != SUCCESS) {
                        ce = tmp_ce;
-                       prop = tmp_info;
                        tmp_ce = tmp_ce->parent;
                }
+
+               if (tmp_info && !(tmp_info->flags & ZEND_ACC_SHADOW)) { /* found something and it's not a parent's private */
+                       prop = tmp_info;
+               } else { /* not found, use initial value */
+                       ce = store_ce;
+               }
        }
 
        MAKE_STD_ZVAL(name);

diff --git a/ext/reflection/tests/bug40431.phpt b/ext/reflection/tests/bug40431.phpt
new file mode 100644 (file)
index 0000000..6e6e4c5
--- /dev/null
+++ b/ext/reflection/tests/bug40431.phpt
@@ -0,0 +1,138 @@
+--TEST--
+Bug #40431 (dynamic properties may cause crash in ReflectionProperty methods)
+--FILE--
+<?php
+
+echo "=== 1st test ===\n";
+
+$Obj->value = 'value';
+$RefObj = new ReflectionObject($Obj);
+
+$props = $RefObj->getProperties();
+
+var_dump($props);
+var_dump($props[0]->isStatic());
+var_dump($props[0]->isPrivate());
+var_dump($props[0]->isPublic());
+var_dump($props[0]->isProtected());
+
+echo "=== 2nd test ===\n";
+
+class test1 {
+}
+
+class test2 extends test1{
+}
+
+$Obj = new test2;
+$Obj->value = 'value';
+$RefObj = new ReflectionObject($Obj);
+
+$props = $RefObj->getProperties();
+
+var_dump($props);
+var_dump($props[0]->isStatic());
+var_dump($props[0]->isPrivate());
+var_dump($props[0]->isPublic());
+var_dump($props[0]->isProtected());
+
+echo "=== 3rd test ===\n";
+
+class test3 {
+}
+
+$Obj = new test3;
+$Obj->value = 'value';
+$RefObj = new ReflectionObject($Obj);
+
+$props = $RefObj->getProperties();
+
+var_dump($props);
+var_dump($props[0]->isStatic());
+var_dump($props[0]->isPrivate());
+var_dump($props[0]->isPublic());
+var_dump($props[0]->isProtected());
+
+echo "=== 4th test ===\n";
+
+class test5 {
+       private $value = 1;
+}
+
+class test4 extends test5{
+}
+
+$Obj = new test4;
+$Obj->value = 'value';
+$RefObj = new ReflectionObject($Obj);
+
+$props = $RefObj->getProperties();
+
+var_dump($props);
+var_dump($props[0]->isStatic());
+var_dump($props[0]->isPrivate());
+var_dump($props[0]->isPublic());
+var_dump($props[0]->isProtected());
+
+echo "Done\n";
+?>
+--EXPECTF--    
+=== 1st test ===
+
+Strict Standards: Creating default object from empty value in %s on line %d
+array(1) {
+  [0]=>
+  &object(ReflectionProperty)#%d (2) {
+    ["name"]=>
+    string(5) "value"
+    ["class"]=>
+    string(8) "stdClass"
+  }
+}
+bool(false)
+bool(false)
+bool(true)
+bool(false)
+=== 2nd test ===
+array(1) {
+  [0]=>
+  &object(ReflectionProperty)#%d (2) {
+    ["name"]=>
+    string(5) "value"
+    ["class"]=>
+    string(5) "test2"
+  }
+}
+bool(false)
+bool(false)
+bool(true)
+bool(false)
+=== 3rd test ===
+array(1) {
+  [0]=>
+  &object(ReflectionProperty)#%d (2) {
+    ["name"]=>
+    string(5) "value"
+    ["class"]=>
+    string(5) "test3"
+  }
+}
+bool(false)
+bool(false)
+bool(true)
+bool(false)
+=== 4th test ===
+array(1) {
+  [0]=>
+  &object(ReflectionProperty)#%d (2) {
+    ["name"]=>
+    string(5) "value"
+    ["class"]=>
+    string(5) "test4"
+  }
+}
+bool(false)
+bool(false)
+bool(true)
+bool(false)
+Done