Re: Magic getter bug tickled by Moodle

Hey: On Sat, Jan 31, 2015 at 3:15 PM, Rasmus Lerdorf <rasmus@lerdorf.com> wrote: > On 01/30/2015 11:13 PM, Michael Wallner wrote: >> >> On 31 Jan 2015 06:04, "Rasmus Lerdorf" <rasmus@lerdorf.com >> <mailto:rasmus@lerdorf.com>> wrote: >>> >>> There is something weird going on with PHP7 and the moodle_page class >>> and all its magic methods. It dies with a: >>> >>> /var/www/moodle/blocks/navigation/block_navigation.php(223) : Notice - >>> Undefined property: moodle_page::$navigation >>> /var/www/moodle/blocks/navigation/block_navigation.php(223) : Fatal >>> error - __clone method called on non-object >>> >>> That code is: >>> >>> 222 $this->page->navigation->initialise(); >>> 223 return clone($this->page->navigation); >>> >>> See: >>> >> >> https://github.com/moodle/moodle/blob/master/blocks/navigation/block_navigation.php#L222-L223 >>> >>> $this->page_navigation is created on that initial call through the >>> wonders of this magic: >>> >>> >>> https://github.com/moodle/moodle/blob/master/lib/pagelib.php#L757-L772 >>> >>> Which somehow leads us to read 8 bytes in a free'ed block: >>> >>> https://gist.github.com/anonymous/f9d1f53b1205d29d86cc >>> >>> but I am not having much luck dwindling it down to a simpler reproduce >>> case. If you know this code or have a couple of hours to spare, could >>> you see if you could reduce it to something more manageable for us? >>> >>> (and yes, same code is fine in 5.6) >>> >> >> Here's a similar bug, too: >> https://bugs.php.net/bug.php?id=68933&edit=1 > > Ah, good catch. Yes, > https://gist.github.com/arjenschol/3d94195ca51aa44db1c6 looks > like a > similar pattern to what Moodle is doing in that part of the code that > seems to trigger this. must be fixed, https://github.com/php/php-src/commit/1a60175e2595a24ebc3b6d80a112d574c6c98f58 thanks > > -Rasmus > -- Xinchen Hui @Laruence http://www.laruence.com/