From: Dmitry Stogov <dmitry@php.net>
Date: Wed, 2 May 2007 13:22:15 +0000 (+0000)
Subject: Fixed altering $this via argument named "this"
X-Git-Tag: RELEASE_1_2_0~181
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=7228f2307bb05907ec126fd6b54613aefefc59b8;p=php

Fixed altering $this via argument named "this"
---

diff --git a/Zend/tests/bug41117_1.phpt b/Zend/tests/bug41117_1.phpt
new file mode 100755
index 0000000000..f555b637ad
--- /dev/null
+++ b/Zend/tests/bug41117_1.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #41117 (Altering $this via argument)
+--FILE--
+<?php
+class foo {
+  function __construct($this) {
+    echo $this."\n";
+  }
+}
+$obj = new foo("Hello world");
+?>
+--EXPECTF--
+Fatal error: Cannot re-assign $this in %sbug41117_1.php on line 3
+
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 40da0a4c58..f758e4cdb0 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -1342,9 +1342,18 @@ void zend_do_end_function_declaration(znode *function_token TSRMLS_DC)
 
 void zend_do_receive_arg(zend_uchar op, znode *var, znode *offset, znode *initialization, znode *class_type, znode *varname, zend_uchar pass_by_reference TSRMLS_DC)
 {
-	zend_op *opline = get_next_op(CG(active_op_array) TSRMLS_CC);
+	zend_op *opline;
 	zend_arg_info *cur_arg_info;
 
+	if (CG(active_op_array)->scope &&
+		((CG(active_op_array)->fn_flags & ZEND_ACC_STATIC) == 0) &&
+	    (Z_TYPE(varname->u.constant) == IS_STRING || Z_TYPE(varname->u.constant) == IS_UNICODE) &&
+	    Z_UNILEN(varname->u.constant) == (sizeof("this")-1) &&
+	    ZEND_U_EQUAL(Z_TYPE(varname->u.constant), Z_UNIVAL(varname->u.constant), Z_UNILEN(varname->u.constant), "this", sizeof("this")-1)) {
+		zend_error(E_COMPILE_ERROR, "Cannot re-assign $this");
+	}
+
+	opline = get_next_op(CG(active_op_array) TSRMLS_CC);
 	CG(active_op_array)->num_args++;
 	opline->opcode = op;
 	opline->result = *var;