Skip to content

Commit 2e20074

Browse files
arnaud-lbarnaud-lb
committed
Merge branch 'PHP-8.5'
* PHP-8.5: Fix phpGH-20875: Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies
2 parents e39b6b9 + 5485f8e commit 2e20074

File tree

5 files changed

+158
-11
lines changed

5 files changed

+158
-11
lines changed

‎Zend/tests/lazy_objects/gh20854.phpt‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
--TEST--
2+
GH-20854 (Assertion in ZEND_RETURN_BY_REF with lazy proxy and return-by-ref __get)
3+
--FILE--
4+
<?php
5+
class C {
6+
public $prop;
7+
8+
function &__get($name) {
9+
return $this->x;
10+
}
11+
}
12+
13+
$rc = new ReflectionClass(C::class);
14+
$obj = $rc->newLazyProxy(function () {
15+
return new C;
16+
});
17+
$obj->x;
18+
echo "Done\n";
19+
?>
20+
--EXPECTF--
21+
Deprecated: Creation of dynamic property C::$x is deprecated in %s on line %d
22+
Done

‎Zend/tests/lazy_objects/gh20873.phpt‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
--TEST--
2+
GH-20873 (Assertion failure in _zendi_try_convert_scalar_to_number with lazy proxy)
3+
--FILE--
4+
<?php
5+
class A {
6+
public $_;
7+
public function __get($n) {
8+
global $obj;
9+
$obj->x =& $this->_;
10+
static $a = $a;
11+
$e =& $this->_ - $a;
12+
}
13+
}
14+
$rc = new ReflectionClass(A::class);
15+
$obj = $rc->newLazyProxy(fn() => new A);
16+
$rc->initializeLazyObject($obj);
17+
var_dump($obj->p);
18+
?>
19+
--EXPECTF--
20+
Deprecated: Creation of dynamic property A::$x is deprecated in %s on line %d
21+
22+
Warning: Undefined variable $a in %s on line %d
23+
24+
Notice: Indirect modification of overloaded property A::$x has no effect in %s on line %d
25+
26+
Fatal error: Uncaught Error: Cannot assign by reference to overloaded object in %s:%d
27+
Stack trace:
28+
#0 %s(%d): A->__get('p')
29+
#1 {main}
30+
thrown in %s on line %d

‎Zend/tests/lazy_objects/gh20875.phpt‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
--TEST--
2+
GH-20875 (Assertion failure in _get_zval_ptr_tmp with lazy proxy)
3+
--FILE--
4+
<?php
5+
class A {
6+
public $_;
7+
public function __get($name) {
8+
global $obj;
9+
$obj->f =& $this->b - $x > $y = new StdClass;
10+
static $a = $a;
11+
$t = 'x';
12+
foreach (get_defined_vars() as $key => $e) {}
13+
if ($v ==!1) $x = $a ?: $t = "ok";
14+
}
15+
}
16+
$rc = new ReflectionClass(A::class);
17+
$obj = $rc->newLazyProxy(function () { return new A; });
18+
$real = $rc->initializeLazyObject($obj);
19+
var_dump($real->prop);
20+
?>
21+
--EXPECTF--
22+
Deprecated: Creation of dynamic property A::$b is deprecated in %s on line %d
23+
24+
Deprecated: Creation of dynamic property A::$f is deprecated in %s on line %d
25+
26+
Warning: Undefined variable $x in %s on line %d
27+
28+
Notice: Object of class stdClass could not be converted to int in %s on line %d
29+
30+
Warning: Undefined variable $a in %s on line %d
31+
32+
Warning: Undefined variable $v in %s on line %d
33+
34+
Notice: Indirect modification of overloaded property A::$b has no effect in %s on line %d
35+
36+
Warning: Undefined variable $x in %s on line %d
37+
38+
Notice: Object of class stdClass could not be converted to int in %s on line %d
39+
40+
Warning: Undefined variable $v in %s on line %d
41+
42+
Notice: Indirect modification of overloaded property A::$f has no effect in %s on line %d
43+
44+
Fatal error: Uncaught Error: Cannot assign by reference to overloaded object in %s:%d
45+
Stack trace:
46+
#0 %s(%d): A->__get('b')
47+
#1 %s(%d): A->__get('prop')
48+
#2 {main}
49+
thrown in %s on line %d

‎Zend/tests/lazy_objects/gh20875_proxy_get_no_init.phpt‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
--TEST--
2+
GH-20875 (Lazy proxy should not initialize when __get handles dynamic property access)
3+
--FILE--
4+
<?php
5+
6+
class Foo {
7+
public $_;
8+
9+
public function &__get($name) {
10+
echo "__get\n";
11+
return $name;
12+
}
13+
}
14+
15+
$proxy = (new ReflectionClass(Foo::class))->newLazyProxy(function () {
16+
echo "init\n";
17+
return new Foo();
18+
});
19+
$x = &$proxy->x;
20+
21+
?>
22+
--EXPECT--
23+
__get

‎Zend/zend_object_handlers.c‎

Lines changed: 34 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1409,12 +1409,24 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *nam
14091409
UNEXPECTED((*zend_get_property_guard(zobj, name)) & IN_GET) ||
14101410
UNEXPECTED(prop_info && (Z_PROP_FLAG_P(retval) & IS_PROP_UNINIT))) {
14111411
if (UNEXPECTED(zend_lazy_object_must_init(zobj) && (Z_PROP_FLAG_P(retval) & IS_PROP_LAZY))) {
1412-
zobj = zend_lazy_object_init(zobj);
1413-
if (!zobj) {
1412+
bool guarded = zobj->ce->__get
1413+
&& (*zend_get_property_guard(zobj, name) & IN_GET);
1414+
zend_object *instance = zend_lazy_object_init(zobj);
1415+
if (!instance) {
14141416
return &EG(error_zval);
14151417
}
14161418

1417-
return zend_std_get_property_ptr_ptr(zobj, name, type, cache_slot);
1419+
if (guarded && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
1420+
uint32_t *guard = zend_get_property_guard(instance, name);
1421+
if (!(*guard & IN_GET)) {
1422+
(*guard) |= IN_GET;
1423+
retval = zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1424+
(*guard) &= ~IN_GET;
1425+
return retval;
1426+
}
1427+
}
1428+
1429+
return zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
14181430
}
14191431
if (UNEXPECTED(type == BP_VAR_RW)) {
14201432
if (prop_info) {
@@ -1457,6 +1469,25 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *nam
14571469
}
14581470
if (EXPECTED(!zobj->ce->__get) ||
14591471
UNEXPECTED((*zend_get_property_guard(zobj, name)) & IN_GET)) {
1472+
if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1473+
bool guarded = (zobj->ce->__get != NULL);
1474+
zend_object *instance = zend_lazy_object_init(zobj);
1475+
if (!instance) {
1476+
return &EG(error_zval);
1477+
}
1478+
1479+
if (guarded && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
1480+
uint32_t *guard = zend_get_property_guard(instance, name);
1481+
if (!(*guard & IN_GET)) {
1482+
(*guard) |= IN_GET;
1483+
retval = zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1484+
(*guard) &= ~IN_GET;
1485+
return retval;
1486+
}
1487+
}
1488+
1489+
return zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1490+
}
14601491
if (UNEXPECTED(zobj->ce->ce_flags & ZEND_ACC_NO_DYNAMIC_PROPERTIES)) {
14611492
zend_forbidden_dynamic_property(zobj->ce, name);
14621493
return &EG(error_zval);
@@ -1466,14 +1497,6 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *nam
14661497
return &EG(error_zval);
14671498
}
14681499
}
1469-
if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1470-
zobj = zend_lazy_object_init(zobj);
1471-
if (!zobj) {
1472-
return &EG(error_zval);
1473-
}
1474-
1475-
return zend_std_get_property_ptr_ptr(zobj, name, type, cache_slot);
1476-
}
14771500
if (UNEXPECTED(!zobj->properties)) {
14781501
rebuild_object_properties_internal(zobj);
14791502
}

0 commit comments

Comments
 (0)