Bug #72813 [Ver->Csd]: Segfault with __get returned by ref
| From: | laruence@php.net | Date: | Fri, 12 Aug 2016 08:41:08 +0000 |
| Subject: | Bug #72813 [Ver->Csd]: Segfault with __get returned by ref | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-203204@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=72813&edit=1
ID: 72813
Updated by: laruence@php.net
Reported by: smilimko at gmail dot com
Summary: Segfault with __get returned by ref
-Status: Verified
+Status: Closed
Type: Bug
Package: Class/Object related
Operating System: Windows 10
PHP Version: 7.0.9
Assigned To: laruence
Block user comment: N
Private report: N
New Comment:
Automatic comment on behalf of laruence@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=e03480bfabce62916d57013d27069e3f46fc7730
Log: Fixed bug #72813 (Segfault with __get returned by ref)
Previous Comments:
------------------------------------------------------------------------
[2016-08-12 07:55:23] laruence@php.net
actually, this leads to a uaf problem....
------------------------------------------------------------------------
[2016-08-11 13:10:54] smilimko at gmail dot com
Description:
------------
I use PHP 7.0.4
When I run the script represented below I get the different result for versions 5.6.* and 7.0. If it
is not a bug I would want to know what changes were made in PHP that may cause that different
behavior.
Test script:
---------------
class Test
{
private $props = ['a' => 'text', 'b' => 1];
public function &__get($prop)
{
return $this->props[$prop];
}
public function __set($prop, $value)
{
if ($prop === 'b') $value = [$value];
$this->props[$prop] = $value;
}
public function getProperties()
{
return [$this->props];
}
}
$obj = new Test;
$obj->b = $obj->b;
print_r($obj->getProperties());
Expected result:
----------------
Array
(
[0] => Array
(
[a] => text
[b] => Array
(
[0] => 1
)
)
)
Actual result:
--------------
Array
(
[0] => Array
(
[a] => text
[b] => Array
*RECURSION*
)
)
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=72813&edit=1