Bug #75655 [Asn->Csd]: Segfault when using magic methods AND reference to self in property
| From: | cmb@php.net | Date: | Thu, 14 Dec 2017 15:12:04 +0000 |
| Subject: | Bug #75655 [Asn->Csd]: Segfault when using magic methods AND reference to self in property | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-213099@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=75655&edit=1
ID: 75655
Updated by: cmb@php.net
Reported by: michael at imagely dot com
Summary: Segfault when using magic methods AND reference to
self in property
-Status: Assigned
+Status: Closed
Type: Bug
Package: Scripting Engine problem
Operating System: Any
PHP Version: 7.2.0
Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
Thanks! Closing.
Previous Comments:
------------------------------------------------------------------------
[2017-12-14 14:55:50] michael at imagely dot com
Yes it has. Thanks!
------------------------------------------------------------------------
[2017-12-10 18:53:08] cmb@php.net
Can you please check whether this issue has been resolved in the
latest RCs? See <http://qa.php.net/> and
<http://windows.php.net/qa/>, respectively.
------------------------------------------------------------------------
[2017-12-08 20:42:03] michael at imagely dot com
Related to Bug #75573
------------------------------------------------------------------------
[2017-12-08 18:59:59] michael at imagely dot com
Description:
------------
This will produce a segfault in PHP 7.2, 7.1.12, and 7.0.26. Any other versions will execute this
and exit clean.
The example code is extracted from NextGEN Gallery, a popular WordPress plugin with over 1 million
installs. The code is used extensively by the plugin and therefore causing major havoc.
If you remove "$this->object = $this", the segfault will not occur.
Test script:
---------------
<?php
class ExtensibleObject
{
var $object = NULL;
function __construct()
{
$this->object = $this;
}
}
class C_DataMapper_Model extends ExtensibleObject
{
var $_stdObject = NULL;
function __construct()
{
parent::__construct();
$this->_stdObject = new stdClass();
}
function &__get($property)
{
if (isset($this->_stdObject->$property)) {
$retval = &$this->_stdObject->$property;
return $retval;
}
else {
// We need to assign NULL to a variable first, since only
// variables can be returned by reference
$retval = NULL;
return $retval;
}
}
function &__set($property, $value)
{
$retval = $this->_stdObject->$property= $value;
return $retval;
}
function __isset($property_name)
{
return isset($this->_stdObject->$property_name);
}
}
class C_Display_Type extends C_DataMapper_Model
{
function __construct()
{
parent::__construct();
}
function &__get($property)
{
if (isset($this->settings) && isset($this->settings[$property])) {
$retval = &$this->settings[$property];
return $retval;
}
else return parent::__get($property);
}
}
// This will segfault
$display_type = new C_Display_Type();
if (!isset($display_type->settings)) $display_type->settings = array();
for ($i=0; $i<10; $i++) {
$key = 'foo_'.$i;
$display_type->settings[$key] = 'bar';
}
var_dump($display_type->settings);
Expected result:
----------------
array(10) {
["foo_0"]=>
string(3) "bar"
["foo_1"]=>
string(3) "bar"
["foo_2"]=>
string(3) "bar"
["foo_3"]=>
string(3) "bar"
["foo_4"]=>
string(3) "bar"
["foo_5"]=>
string(3) "bar"
["foo_6"]=>
string(3) "bar"
["foo_7"]=>
string(3) "bar"
["foo_8"]=>
string(3) "bar"
["foo_9"]=>
string(3) "bar"
}
Actual result:
--------------
Segmentation fault (core dumped)
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=75655&edit=1