Fixed bug #64007 (There is an ability to create instance of Generator by hand).

Use get_constrctor instead of access of the ce->constructor directly

diff --git a/NEWS b/NEWS
index 3bb0373d3b72dc71540d72abebaa301eff02f0de..89fcad3acf5ff058c12159f1e57793d015337c5a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -42,6 +42,10 @@ PHP                                                                        NEWS
   . Bug #62489: dba_insert not working as expected.
     (marc-bennewitz at arcor dot de, Lars)
 
+- Reflection:
+  . Fixed bug #64007 (There is an ability to create instance of Generator by hand).
+    (Laruence)
+
 18 Dec 2012, PHP 5.5.0 Alpha 2
 
 - General improvements:

diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index ff3a6a508728825ddf480a5810dac0b44c14eec0..5c844b8d4dd516df284abd125abc1475dd9914de 100644 (file)
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -4192,13 +4192,21 @@ ZEND_METHOD(reflection_class, newInstance)
 {
        zval *retval_ptr = NULL;
        reflection_object *intern;
-       zend_class_entry *ce;
+       zend_class_entry *ce, *old_scope;
+       zend_function *constructor;
 
        METHOD_NOTSTATIC(reflection_class_ptr);
        GET_REFLECTION_OBJECT_PTR(ce);
 
+       object_init_ex(return_value, ce);
+
+       old_scope = EG(scope);
+       EG(scope) = ce;
+       constructor = Z_OBJ_HT_P(return_value)->get_constructor(return_value TSRMLS_CC);
+       EG(scope) = old_scope;
+
        /* Run the constructor if there is one */
-       if (ce->constructor) {
+       if (constructor) {
                zval ***params = NULL;
                int num_args = 0;
                zend_fcall_info fci;
@@ -4206,18 +4214,18 @@ ZEND_METHOD(reflection_class, newInstance)
 
                if (!(ce->constructor->common.fn_flags & ZEND_ACC_PUBLIC)) {
                        zend_throw_exception_ex(reflection_exception_ptr, 0 TSRMLS_CC, "Access to non-public constructor of class %s", ce->name);
-                       return;
+                       zval_dtor(return_value);
+                       RETURN_NULL();
                }
 
                if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "*", &params, &num_args) == FAILURE) {
                        if (params) {
                                efree(params);
                        }
+                       zval_dtor(return_value);
                        RETURN_FALSE;
                }
 
-               object_init_ex(return_value, ce);
-
                fci.size = sizeof(fci);
                fci.function_table = EG(function_table);
                fci.function_name = NULL;
@@ -4242,6 +4250,7 @@ ZEND_METHOD(reflection_class, newInstance)
                                zval_ptr_dtor(&retval_ptr);
                        }
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invocation of %s's constructor failed", ce->name);
+                       zval_dtor(return_value);
                        RETURN_NULL();
                }
                if (retval_ptr) {
@@ -4250,9 +4259,7 @@ ZEND_METHOD(reflection_class, newInstance)
                if (params) {
                        efree(params);
                }
-       } else if (!ZEND_NUM_ARGS()) {
-               object_init_ex(return_value, ce);
-       } else {
+       } else if (ZEND_NUM_ARGS()) {
                zend_throw_exception_ex(reflection_exception_ptr, 0 TSRMLS_CC, "Class %s does not have a constructor, so you cannot pass any constructor arguments", ce->name);
        }
 }

diff --git a/ext/reflection/tests/bug64007.phpt b/ext/reflection/tests/bug64007.phpt
new file mode 100644 (file)
index 0000000..34aac7a
--- /dev/null
+++ b/ext/reflection/tests/bug64007.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #64007 (There is an ability to create instance of Generator by hand)
+--FILE--
+<?php
+$reflection = new ReflectionClass('Generator');
+$generator  = $reflection->newInstance();
+var_dump($generator);
+?>
+--EXPECTF--
+Catchable fatal error: The "Generator" class is reserved for internal use and cannot be manually instantiated in %sbug64007.php on line %d