From: Gustavo André dos Santos Lopes <cataphract@php.net>
Date: Sun, 18 Mar 2012 18:23:27 +0000 (+0000)
Subject: - Fixed bug #61388 (ReflectionObject:getProperties() issues invalid reads
X-Git-Tag: PHP-5.4.1-RC1~26^2~1
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=227112cb0fb732d86da376e1b8ccc9dab2a5e225;p=php

- Fixed bug #61388 (ReflectionObject:getProperties() issues invalid reads
  when get_properties returns a hash table with (inaccessible) dynamic
  numeric properties).
---

diff --git a/NEWS b/NEWS
index 7f81598b16..7563155c76 100644
--- a/NEWS
+++ b/NEWS
@@ -72,6 +72,13 @@ PHP                                                                        NEWS
   . Fixed bug #61088 (Memory leak in readline_callback_handler_install).
     (Nikic, Laruence)
 
+- Reflection:
+  . Fixed bug #61388 (ReflectionObject:getProperties() issues invalid reads
+    when get_properties returns a hash table with (inaccessible) dynamic
+    numeric properties). (Gustavo)
+  . Fixed bug #60968 (Late static binding doesn't work with 
+    ReflectionMethod::invokeArgs()). (Laruence)
+
 - SOAP
   . Fixed basic HTTP authentication for WSDL sub requests. (Dmitry)
   . Fixed bug #60887 (SoapClient ignores user_agent option and sends no
@@ -90,10 +97,6 @@ PHP                                                                        NEWS
 - SQLite3 extension:
   . Add createCollation() method. (Brad Dewar)
 
-- Reflection:
-  . Fixed bug #60968 (Late static binding doesn't work with 
-    ReflectionMethod::invokeArgs()). (Laruence)
-
 - Session:
   . Fixed bug #60860 (session.save_handler=user without defined function core
     dumps). (Felipe)
diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index 06f806f289..94cc05ee58 100644
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -3667,6 +3667,13 @@ static int _adddynproperty(zval **pptr TSRMLS_DC, int num_args, va_list args, ze
 	zend_class_entry *ce = *va_arg(args, zend_class_entry**);
 	zval *retval = va_arg(args, zval*), member;
 
+	/* under some circumstances, the properties hash table may contain numeric
+	 * properties (e.g. when casting from array). This is a WONT FIX bug, at
+	 * least for the moment. Ignore these */
+	if (hash_key->nKeyLength == 0) {
+		return 0;
+	}
+
 	if (hash_key->arKey[0] == '\0') {
 		return 0; /* non public cannot be dynamic */
 	}
diff --git a/ext/reflection/tests/bug61388.phpt b/ext/reflection/tests/bug61388.phpt
new file mode 100644
index 0000000000..75c0300151
--- /dev/null
+++ b/ext/reflection/tests/bug61388.phpt
@@ -0,0 +1,32 @@
+--TEST--
+ReflectionObject:getProperties() issues invalid reads when it get_properties returns a hash table with (inaccessible) dynamic numeric properties
+--FILE--
+<?php
+$x = new ArrayObject();
+$x[0] = 'test string 2';
+$x['test'] = 'test string 3';
+$reflObj = new ReflectionObject($x);
+print_r($reflObj->getProperties(ReflectionProperty::IS_PUBLIC));
+
+$x = (object)array("a", "oo" => "b");
+$reflObj = new ReflectionObject($x);
+print_r($reflObj->getProperties(ReflectionProperty::IS_PUBLIC));
+--EXPECT--
+Array
+(
+    [0] => ReflectionProperty Object
+        (
+            [name] => test
+            [class] => ArrayObject
+        )
+
+)
+Array
+(
+    [0] => ReflectionProperty Object
+        (
+            [name] => oo
+            [class] => stdClass
+        )
+
+)