svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/ext/reflection/php_reflection.c branches/PHP_5_3/ext/reflection/tests/bug61388.phpt
branches/PHP_5_4/ext/reflection/php_reflection.c branches/PHP_5_4/ext/reflection/tests/bug61388.phpt trunk/ext/reflection/php_reflection.c
trunk/ext/reflection/tests/bug61388.phpt

cataphract Sun, 18 Mar 2012 18:23:27 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=324337 Log: - Fixed bug #61388 (ReflectionObject:getProperties() issues invalid reads when get_properties returns a hash table with (inaccessible) dynamic numeric properties). Bug: https://bugs.php.net/61388 (Assigned) ReflectionObject:getProperties called on ArrayObject throws Segmentation Fault Changed paths: U php/php-src/branches/PHP_5_3/NEWS U php/php-src/branches/PHP_5_3/ext/reflection/php_reflection.c A php/php-src/branches/PHP_5_3/ext/reflection/tests/bug61388.phpt U php/php-src/branches/PHP_5_4/ext/reflection/php_reflection.c A php/php-src/branches/PHP_5_4/ext/reflection/tests/bug61388.phpt U php/php-src/trunk/ext/reflection/php_reflection.c A php/php-src/trunk/ext/reflection/tests/bug61388.phpt Modified: php/php-src/branches/PHP_5_3/NEWS =================================================================== --- php/php-src/branches/PHP_5_3/NEWS 2012-03-18 18:18:01 UTC (rev 324336) +++ php/php-src/branches/PHP_5_3/NEWS 2012-03-18 18:23:27 UTC (rev 324337) @@ -72,6 +72,13 @@ . Fixed bug #61088 (Memory leak in readline_callback_handler_install). (Nikic, Laruence) +- Reflection: + . Fixed bug #61388 (ReflectionObject:getProperties() issues invalid reads + when get_properties returns a hash table with (inaccessible) dynamic + numeric properties). (Gustavo) + . Fixed bug #60968 (Late static binding doesn't work with + ReflectionMethod::invokeArgs()). (Laruence) + - SOAP . Fixed basic HTTP authentication for WSDL sub requests. (Dmitry) . Fixed bug #60887 (SoapClient ignores user_agent option and sends no @@ -90,10 +97,6 @@ - SQLite3 extension: . Add createCollation() method. (Brad Dewar) -- Reflection: - . Fixed bug #60968 (Late static binding doesn't work with - ReflectionMethod::invokeArgs()). (Laruence) - - Session: . Fixed bug #60860 (session.save_handler=user without defined function core dumps). (Felipe) Modified: php/php-src/branches/PHP_5_3/ext/reflection/php_reflection.c =================================================================== --- php/php-src/branches/PHP_5_3/ext/reflection/php_reflection.c 2012-03-18 18:18:01 UTC (rev 324336) +++ php/php-src/branches/PHP_5_3/ext/reflection/php_reflection.c 2012-03-18 18:23:27 UTC (rev 324337) @@ -3667,6 +3667,13 @@ zend_class_entry *ce = *va_arg(args, zend_class_entry**); zval *retval = va_arg(args, zval*), member; + /* under some circumstances, the properties hash table may contain numeric + * properties (e.g. when casting from array). This is a WONT FIX bug, at + * least for the moment. Ignore these */ + if (hash_key->nKeyLength == 0) { + return 0; + } + if (hash_key->arKey[0] == '\0') { return 0; /* non public cannot be dynamic */ } Added: php/php-src/branches/PHP_5_3/ext/reflection/tests/bug61388.phpt =================================================================== --- php/php-src/branches/PHP_5_3/ext/reflection/tests/bug61388.phpt (rev 0) +++ php/php-src/branches/PHP_5_3/ext/reflection/tests/bug61388.phpt 2012-03-18 18:23:27 UTC (rev 324337) @@ -0,0 +1,32 @@ +--TEST-- +ReflectionObject:getProperties() issues invalid reads when it get_properties returns a hash table with (inaccessible) dynamic numeric properties +--FILE-- +<?php +$x = new ArrayObject(); +$x[0] = 'test string 2'; +$x['test'] = 'test string 3'; +$reflObj = new ReflectionObject($x); +print_r($reflObj->getProperties(ReflectionProperty::IS_PUBLIC)); + +$x = (object)array("a", "oo" => "b"); +$reflObj = new ReflectionObject($x); +print_r($reflObj->getProperties(ReflectionProperty::IS_PUBLIC)); +--EXPECT-- +Array +( + [0] => ReflectionProperty Object + ( + [name] => test + [class] => ArrayObject + ) + +) +Array +( + [0] => ReflectionProperty Object + ( + [name] => oo + [class] => stdClass + ) + +) Property changes on: php/php-src/branches/PHP_5_3/ext/reflection/tests/bug61388.phpt ___________________________________________________________________ Added: svn:keywords + Id Rev Revision Added: svn:eol-style + native Modified: php/php-src/branches/PHP_5_4/ext/reflection/php_reflection.c =================================================================== --- php/php-src/branches/PHP_5_4/ext/reflection/php_reflection.c 2012-03-18 18:18:01 UTC (rev 324336) +++ php/php-src/branches/PHP_5_4/ext/reflection/php_reflection.c 2012-03-18 18:23:27 UTC (rev 324337) @@ -3832,6 +3832,13 @@ zend_class_entry *ce = *va_arg(args, zend_class_entry**); zval *retval = va_arg(args, zval*), member; + /* under some circumstances, the properties hash table may contain numeric + * properties (e.g. when casting from array). This is a WONT FIX bug, at + * least for the moment. Ignore these */ + if (hash_key->nKeyLength == 0) { + return 0; + } + if (hash_key->arKey[0] == '\0') { return 0; /* non public cannot be dynamic */ } Added: php/php-src/branches/PHP_5_4/ext/reflection/tests/bug61388.phpt =================================================================== --- php/php-src/branches/PHP_5_4/ext/reflection/tests/bug61388.phpt (rev 0) +++ php/php-src/branches/PHP_5_4/ext/reflection/tests/bug61388.phpt 2012-03-18 18:23:27 UTC (rev 324337) @@ -0,0 +1,32 @@ +--TEST-- +ReflectionObject:getProperties() issues invalid reads when it get_properties returns a hash table with (inaccessible) dynamic numeric properties +--FILE-- +<?php +$x = new ArrayObject(); +$x[0] = 'test string 2'; +$x['test'] = 'test string 3'; +$reflObj = new ReflectionObject($x); +print_r($reflObj->getProperties(ReflectionProperty::IS_PUBLIC)); + +$x = (object)array("a", "oo" => "b"); +$reflObj = new ReflectionObject($x); +print_r($reflObj->getProperties(ReflectionProperty::IS_PUBLIC)); +--EXPECT-- +Array +( + [0] => ReflectionProperty Object + ( + [name] => test + [class] => ArrayObject + ) + +) +Array +( + [0] => ReflectionProperty Object + ( + [name] => oo + [class] => stdClass + ) + +) Property changes on: php/php-src/branches/PHP_5_4/ext/reflection/tests/bug61388.phpt ___________________________________________________________________ Added: svn:keywords + Id Rev Revision Added: svn:eol-style + native Modified: php/php-src/trunk/ext/reflection/php_reflection.c =================================================================== --- php/php-src/trunk/ext/reflection/php_reflection.c 2012-03-18 18:18:01 UTC (rev 324336) +++ php/php-src/trunk/ext/reflection/php_reflection.c 2012-03-18 18:23:27 UTC (rev 324337) @@ -3832,6 +3832,13 @@ zend_class_entry *ce = *va_arg(args, zend_class_entry**); zval *retval = va_arg(args, zval*), member; + /* under some circumstances, the properties hash table may contain numeric + * properties (e.g. when casting from array). This is a WONT FIX bug, at + * least for the moment. Ignore these */ + if (hash_key->nKeyLength == 0) { + return 0; + } + if (hash_key->arKey[0] == '\0') { return 0; /* non public cannot be dynamic */ } Added: php/php-src/trunk/ext/reflection/tests/bug61388.phpt =================================================================== --- php/php-src/trunk/ext/reflection/tests/bug61388.phpt (rev 0) +++ php/php-src/trunk/ext/reflection/tests/bug61388.phpt 2012-03-18 18:23:27 UTC (rev 324337) @@ -0,0 +1,32 @@ +--TEST-- +ReflectionObject:getProperties() issues invalid reads when it get_properties returns a hash table with (inaccessible) dynamic numeric properties +--FILE-- +<?php +$x = new ArrayObject(); +$x[0] = 'test string 2'; +$x['test'] = 'test string 3'; +$reflObj = new ReflectionObject($x); +print_r($reflObj->getProperties(ReflectionProperty::IS_PUBLIC)); + +$x = (object)array("a", "oo" => "b"); +$reflObj = new ReflectionObject($x); +print_r($reflObj->getProperties(ReflectionProperty::IS_PUBLIC)); +--EXPECT-- +Array +( + [0] => ReflectionProperty Object + ( + [name] => test + [class] => ArrayObject + ) + +) +Array +( + [0] => ReflectionProperty Object + ( + [name] => oo + [class] => stdClass + ) + +) Property changes on: php/php-src/trunk/ext/reflection/tests/bug61388.phpt ___________________________________________________________________ Added: svn:keywords + Id Rev Revision Added: svn:eol-style + native