From a1ed4ab3caf33b59742897b43462d033864bb490 Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikic@php.net>
Date: Tue, 10 May 2016 12:13:10 +0200
Subject: [PATCH] Fixed bug #72174

Also fixes a memory leak if ::getValue() is used with __get().
---
 NEWS                                          |  4 +++
 ext/reflection/php_reflection.c               |  8 +++--
 .../ReflectionProperty_getValue_error.phpt    |  2 ++
 ext/reflection/tests/bug72174.phpt            | 36 +++++++++++++++++++
 4 files changed, 48 insertions(+), 2 deletions(-)
 create mode 100644 ext/reflection/tests/bug72174.phpt

diff --git a/NEWS b/NEWS
index 069bf1ecf8..982c9edb9a 100644
--- a/NEWS
+++ b/NEWS
@@ -56,6 +56,10 @@ PHP                                                                        NEWS
     timestamp). (denver at timothy dot io)
   . Fixed bug #72151 (mysqli_fetch_object changed behaviour). (Anatol)
 
+- Reflection:
+  . Fixed bug #72174 (ReflectionProperty#getValue() causes __isset call).
+    (Nikita)
+
 - Session:
   . Fixed bug #71972 (Cyclic references causing session_start(): Failed to
     decode session object). (Laruence)
diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index 50d0ba0023..4c3f6240f4 100644
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -5383,8 +5383,12 @@ ZEND_METHOD(reflection_property, getValue)
 		}
 
 		zend_unmangle_property_name_ex(ref->prop.name, &class_name, &prop_name, &prop_name_len);
-		member_p = zend_read_property(ref->ce, object, prop_name, prop_name_len, 1, &rv);
-		ZVAL_DUP(return_value, member_p);
+		member_p = zend_read_property(ref->ce, object, prop_name, prop_name_len, 0, &rv);
+		if (member_p != &rv) {
+			ZVAL_COPY(return_value, member_p);
+		} else {
+			ZVAL_COPY_VALUE(return_value, member_p);
+		}
 	}
 }
 /* }}} */
diff --git a/ext/reflection/tests/ReflectionProperty_getValue_error.phpt b/ext/reflection/tests/ReflectionProperty_getValue_error.phpt
index c2152e9f87..62009d8bb9 100644
--- a/ext/reflection/tests/ReflectionProperty_getValue_error.phpt
+++ b/ext/reflection/tests/ReflectionProperty_getValue_error.phpt
@@ -78,4 +78,6 @@ Protected property:
 Cannot access non-public member TestClass::prot
 
 Instance without property:
+
+Notice: Undefined property: AnotherClass::$pub2 in %s on line %d
 NULL
diff --git a/ext/reflection/tests/bug72174.phpt b/ext/reflection/tests/bug72174.phpt
new file mode 100644
index 0000000000..94416d6153
--- /dev/null
+++ b/ext/reflection/tests/bug72174.phpt
@@ -0,0 +1,36 @@
+--TEST--
+Bug #72174: ReflectionProperty#getValue() causes __isset call
+--FILE--
+<?php
+
+class Foo
+{
+    private $bar;
+
+    public function __construct()
+    {
+        unset($this->bar);
+    }
+
+    public function __isset($name)
+    {
+        var_dump(__METHOD__);
+        return true;
+    }
+    
+    public function __get($name)
+    {
+        var_dump(__METHOD__);
+        return $name;
+    }
+}
+
+$instance = new Foo();
+$reflectionBar = (new ReflectionProperty(Foo::class, 'bar'));
+$reflectionBar->setAccessible(true);
+var_dump($reflectionBar->getValue($instance));
+
+?>
+--EXPECT--
+string(10) "Foo::__get"
+string(3) "bar"
-- 
2.50.1