com php-src: Fixed bug #71336 (Wrong is_ref on properties as exposed via get_object_vars()): NEWS Zend/tests/bug71336.phpt Zend/zend_builtin
_functions.c

Commit: 39f09507464bfa398c476a64d8b16b4061a3faec Author: Xinchen Hui <laruence@gmail.com> Wed, 13 Jan 2016 17:38:18 +0800 Parents: 50be2c89bed61a1928cd1dd0c226fe62769344dd Branches: PHP-7.0 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=39f09507464bfa398c476a64d8b16b4061a3faec Log: Fixed bug #71336 (Wrong is_ref on properties as exposed via get_object_vars()) Bugs: https://bugs.php.net/71336 Changed paths: M NEWS A Zend/tests/bug71336.phpt M Zend/zend_builtin_functions.c Diff: diff --git a/NEWS b/NEWS index 9ce138a..6cf7504 100644 --- a/NEWS +++ b/NEWS @@ -2,10 +2,9 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2016 PHP 7.0.3 -- Apache2handler: - . Fix >2G Content-Length headers in apache2handler. (Adam Harvey) - - Core: + . Fixed bug #71336 (Wrong is_ref on properties as exposed via + get_object_vars()). (Laruence) . Fixed bug #71248 (Wrong interface is enforced). (Dmitry) . Fixed bug #71300 (Segfault in zend_fetch_string_offset). (Laruence) . Fixed bug #71221 (Null pointer deref (segfault) in get_defined_vars via @@ -19,6 +18,9 @@ PHP NEWS . Fixed bug #71297 (Memory leak with consecutive yield from). (Bob) . Fixed bug #71314 (var_export(INF) prints INF.0). (Andrea) +- Apache2handler: + .. Fix >2G Content-Length headers in apache2handler. (Adam Harvey) + - CURL: . Fixed bug #71227 (Can't compile php_curl statically). (Anatol) . Fixed bug #71225 (curl_setopt() fails to set CURLOPT_POSTFIELDS with diff --git a/Zend/tests/bug71336.phpt b/Zend/tests/bug71336.phpt new file mode 100644 index 0000000..c5da420 --- /dev/null +++ b/Zend/tests/bug71336.phpt @@ -0,0 +1,48 @@ +--TEST-- +Bug #71336 (Wrong is_ref on properties as exposed via get_object_vars()) +--FILE-- +<?php +class A +{ + protected $bar = array('baz'); + + function bar() + { + array_pop($this->bar); + $vars = get_object_vars($this); + $this->bar[] = array('buz'); + print_r($vars); + } + + function foo() { + array_pop($this->bar); + $dummy = &$this->bar; + $vars = get_object_vars($this); + $this->bar[] = array('buz'); + print_r($vars); + } +} + +(new A())->bar(); +(new A())->foo(); +?> +--EXPECT-- +Array +( + [bar] => Array + ( + ) + +) +Array +( + [bar] => Array + ( + [0] => Array + ( + [0] => buz + ) + + ) + +) diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c index ff5fa4f..231424f 100644 --- a/Zend/zend_builtin_functions.c +++ b/Zend/zend_builtin_functions.c @@ -1198,8 +1198,12 @@ ZEND_FUNCTION(get_object_vars) ZEND_HASH_FOREACH_STR_KEY_VAL_IND(properties, key, value) { if (key) { if (zend_check_property_access(zobj, key) == SUCCESS) { - /* Not separating references */ - if (Z_REFCOUNTED_P(value)) Z_ADDREF_P(value); + if (Z_ISREF_P(value) && Z_REFCOUNT_P(value) == 1) { + value = Z_REFVAL_P(value); + } + if (Z_REFCOUNTED_P(value)) { + Z_ADDREF_P(value); + } if (ZSTR_VAL(key)[0] == 0) { const char *prop_name, *class_name; size_t prop_len;