- Fixed bug #52484 (__set() ignores setting properties with empty names)

diff --git a/NEWS b/NEWS
index 352a57928c62ad05de436ecc7225fd882b5bb378..bd38de0f02d8272ff14ced405c973e86c54f2a7a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,8 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2010, PHP 5.3.4
 - Fixed bug #52487 (PDO::FETCH_INTO leaks memory). (Felipe)
+- Fixed bug #52484 (__set() ignores setting properties with empty names).
+  (Felipe)
 - Fixed bug #52436 (Compile error if systems do not have stdint.h)
   (Sriram Natarajan)
 

diff --git a/Zend/tests/bug52484.phpt b/Zend/tests/bug52484.phpt
new file mode 100644 (file)
index 0000000..ccdf858
--- /dev/null
+++ b/Zend/tests/bug52484.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #52484 (__set() ignores setting properties with empty names)
+--FILE--
+<?php
+
+class A {      
+       function __unset($prop) {
+               unset($this->$prop);
+       }
+}
+
+$a = new A();
+$prop = null;
+
+unset($a->$prop);
+
+?>
+--EXPECTF--
+Fatal error: Cannot access empty property in %s on line %d

diff --git a/Zend/tests/bug52484_2.phpt b/Zend/tests/bug52484_2.phpt
new file mode 100644 (file)
index 0000000..1639c81
--- /dev/null
+++ b/Zend/tests/bug52484_2.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #52484.2 (__set() ignores setting properties with empty names)
+--FILE--
+<?php
+
+class A {
+       function __set($prop, $val) {
+               $this->$prop = $val;
+       }
+}
+
+$a = new A();
+$prop = null;
+
+$a->$prop = 2;
+
+?>
+--EXPECTF--
+Fatal error: Cannot access empty property in %s on line %d

diff --git a/Zend/tests/bug52484_3.phpt b/Zend/tests/bug52484_3.phpt
new file mode 100644 (file)
index 0000000..20dde3d
--- /dev/null
+++ b/Zend/tests/bug52484_3.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #52484.3 (__set() ignores setting properties with empty names)
+--FILE--
+<?php
+
+class A {      
+       function __get($prop) {
+               var_dump($this->$prop);
+       }
+}
+
+$a = new A();
+$prop = null;
+
+var_dump($a->$prop);
+
+?>
+--EXPECTF--
+Fatal error: Cannot access empty property in %s on line %d

diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index 1399ef50d57f3783b171028d593f6a65c2100bb6..b91fcd0787dae55e702fe14fe726369d33eaaafd 100644 (file)
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -340,7 +340,7 @@ zval *zend_std_read_property(zval *object, zval *member, int type TSRMLS_DC) /*
        property_info = zend_get_property_info(zobj->ce, member, (zobj->ce->__get != NULL) TSRMLS_CC);
 
        if (!property_info || zend_hash_quick_find(zobj->properties, property_info->name, property_info->name_length+1, property_info->h, (void **) &retval) == FAILURE) {
-               zend_guard *guard;
+               zend_guard *guard = NULL;
 
                if (zobj->ce->__get &&
                    zend_get_property_guard(zobj, property_info, member, &guard) == SUCCESS &&
@@ -373,6 +373,15 @@ zval *zend_std_read_property(zval *object, zval *member, int type TSRMLS_DC) /*
                        }
                        zval_ptr_dtor(&object);
                } else {
+                       if (zobj->ce->__get && guard && guard->in_get == 1) {
+                               if (Z_STRVAL_P(member)[0] == '\0') {
+                                       if (Z_STRLEN_P(member) == 0) {
+                                               zend_error(E_ERROR, "Cannot access empty property");
+                                       } else {
+                                               zend_error(E_ERROR, "Cannot access property started with '\\0'");
+                                       }
+                               }
+                       }
                        if (!silent) {
                                zend_error(E_NOTICE,"Undefined property: %s::$%s", zobj->ce->name, Z_STRVAL_P(member));
                        }
@@ -437,7 +446,7 @@ static void zend_std_write_property(zval *object, zval *member, zval *value TSRM
                }
        } else {
                int setter_done = 0;
-               zend_guard *guard;
+               zend_guard *guard = NULL;
 
                if (zobj->ce->__set &&
                    zend_get_property_guard(zobj, property_info, member, &guard) == SUCCESS &&
@@ -460,6 +469,14 @@ static void zend_std_write_property(zval *object, zval *member, zval *value TSRM
                                SEPARATE_ZVAL(&value);
                        }
                        zend_hash_quick_update(zobj->properties, property_info->name, property_info->name_length+1, property_info->h, &value, sizeof(zval *), (void **) &foo);
+               } else if (zobj->ce->__set && guard && guard->in_set == 1) {
+                       if (Z_STRVAL_P(member)[0] == '\0') {
+                               if (Z_STRLEN_P(member) == 0) {
+                                       zend_error(E_ERROR, "Cannot access empty property");
+                               } else {
+                                       zend_error(E_ERROR, "Cannot access property started with '\\0'");
+                               }
+                       }
                }
        }
 
@@ -619,7 +636,7 @@ static void zend_std_unset_property(zval *object, zval *member TSRMLS_DC) /* {{{
        property_info = zend_get_property_info(zobj->ce, member, (zobj->ce->__unset != NULL) TSRMLS_CC);
 
        if (!property_info || zend_hash_quick_del(zobj->properties, property_info->name, property_info->name_length+1, property_info->h) == FAILURE) {
-               zend_guard *guard;
+               zend_guard *guard = NULL;
 
                if (zobj->ce->__unset &&
                    zend_get_property_guard(zobj, property_info, member, &guard) == SUCCESS &&
@@ -630,6 +647,14 @@ static void zend_std_unset_property(zval *object, zval *member TSRMLS_DC) /* {{{
                        zend_std_call_unsetter(object, member TSRMLS_CC);
                        guard->in_unset = 0;
                        zval_ptr_dtor(&object);
+               } else if (zobj->ce->__unset && guard && guard->in_unset == 1) {
+                       if (Z_STRVAL_P(member)[0] == '\0') {
+                               if (Z_STRLEN_P(member) == 0) {
+                                       zend_error(E_ERROR, "Cannot access empty property");
+                               } else {
+                                       zend_error(E_ERROR, "Cannot access property started with '\\0'");
+                               }
+                       }
                }
        }