From 93288d0095cc27f8df88832e479e25ea5b00b5fd Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikic@php.net>
Date: Fri, 3 Oct 2014 21:24:28 +0200
Subject: [PATCH] Fix bug #68188

---
 NEWS                        |  3 +++
 Zend/tests/bug68118.phpt    | 21 +++++++++++++++++++++
 Zend/zend_object_handlers.c |  9 ++++++---
 3 files changed, 30 insertions(+), 3 deletions(-)
 create mode 100644 Zend/tests/bug68118.phpt

diff --git a/NEWS b/NEWS
index d4f6c3e9fb..00bc110622 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2014, PHP 5.5.19
 
+- Core:
+  . Fixed bug #68188 ($a->foo .= 'test'; can leave $a->foo undefined). (Nikita)
+
 
 ?? ??? 2014, PHP 5.5.18
 
diff --git a/Zend/tests/bug68118.phpt b/Zend/tests/bug68118.phpt
new file mode 100644
index 0000000000..c56e70a112
--- /dev/null
+++ b/Zend/tests/bug68118.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #68118: $a->foo .= 'test'; can leave $a->foo undefined
+--FILE--
+<?php
+
+set_error_handler(function() {
+    $obj = new stdClass;
+    $obj->test = 'meow';
+    return true;
+});
+ 
+$a = new stdClass;
+$a->undefined .= 'test';
+var_dump($a);
+
+?>
+--EXPECT--
+object(stdClass)#2 (1) {
+  ["undefined"]=>
+  string(4) "test"
+}
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index 093951eeca..a7b761fa38 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -754,9 +754,6 @@ static zval **zend_std_get_property_ptr_ptr(zval *object, zval *member, int type
 			/* we don't have access controls - will just add it */
 			new_zval = &EG(uninitialized_zval);
 
-			if(UNEXPECTED(type == BP_VAR_RW || type == BP_VAR_R)) {
-				zend_error(E_NOTICE, "Undefined property: %s::$%s", zobj->ce->name, Z_STRVAL_P(member));
-			}
 			Z_ADDREF_P(new_zval);
 			if (EXPECTED((property_info->flags & ZEND_ACC_STATIC) == 0) &&
 			    property_info->offset >= 0) {
@@ -776,6 +773,12 @@ static zval **zend_std_get_property_ptr_ptr(zval *object, zval *member, int type
 				}
 				zend_hash_quick_update(zobj->properties, property_info->name, property_info->name_length+1, property_info->h, &new_zval, sizeof(zval *), (void **) &retval);
 			}
+
+			/* Notice is thrown after creation of the property, to avoid EG(std_property_info)
+			 * being overwritten in an error handler. */
+			if (UNEXPECTED(type == BP_VAR_RW || type == BP_VAR_R)) {
+				zend_error(E_NOTICE, "Undefined property: %s::$%s", zobj->ce->name, Z_STRVAL_P(member));
+			}
 		} else {
 			/* we do have getter - fail and let it try again with usual get/set */
 			retval = NULL;
-- 
2.40.0