Skip to content

Commit 5485f8e

Browse files
arnaud-lbarnaud-lb
committed
Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4: Fix GH-20875: Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies
2 parents f134227 + 9ec303e commit 5485f8e

File tree

6 files changed

+160
-11
lines changed

6 files changed

+160
-11
lines changed

‎NEWS‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ PHP NEWS
55
- Core:
66
. Fixed bug GH-20672 (Incorrect property_info sizing for locally shadowed
77
trait properties). (ilutov)
8+
. Fixed bugs GH-20875, GH-20873, GH-20854 (Propagate IN_GET guard in
9+
get_property_ptr_ptr for lazy proxies). (iliaal)
810

911
- Bz2:
1012
. Fix truncation of total output size causing erroneous errors. (ndossche)

‎Zend/tests/lazy_objects/gh20854.phpt‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
--TEST--
2+
GH-20854 (Assertion in ZEND_RETURN_BY_REF with lazy proxy and return-by-ref __get)
3+
--FILE--
4+
<?php
5+
class C {
6+
public $prop;
7+
8+
function &__get($name) {
9+
return $this->x;
10+
}
11+
}
12+
13+
$rc = new ReflectionClass(C::class);
14+
$obj = $rc->newLazyProxy(function () {
15+
return new C;
16+
});
17+
$obj->x;
18+
echo "Done\n";
19+
?>
20+
--EXPECTF--
21+
Deprecated: Creation of dynamic property C::$x is deprecated in %s on line %d
22+
Done

‎Zend/tests/lazy_objects/gh20873.phpt‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
--TEST--
2+
GH-20873 (Assertion failure in _zendi_try_convert_scalar_to_number with lazy proxy)
3+
--FILE--
4+
<?php
5+
class A {
6+
public $_;
7+
public function __get($n) {
8+
global $obj;
9+
$obj->x =& $this->_;
10+
static $a = $a;
11+
$e =& $this->_ - $a;
12+
}
13+
}
14+
$rc = new ReflectionClass(A::class);
15+
$obj = $rc->newLazyProxy(fn() => new A);
16+
$rc->initializeLazyObject($obj);
17+
var_dump($obj->p);
18+
?>
19+
--EXPECTF--
20+
Deprecated: Creation of dynamic property A::$x is deprecated in %s on line %d
21+
22+
Warning: Undefined variable $a in %s on line %d
23+
24+
Notice: Indirect modification of overloaded property A::$x has no effect in %s on line %d
25+
26+
Fatal error: Uncaught Error: Cannot assign by reference to overloaded object in %s:%d
27+
Stack trace:
28+
#0 %s(%d): A->__get('p')
29+
#1 {main}
30+
thrown in %s on line %d

‎Zend/tests/lazy_objects/gh20875.phpt‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
--TEST--
2+
GH-20875 (Assertion failure in _get_zval_ptr_tmp with lazy proxy)
3+
--FILE--
4+
<?php
5+
class A {
6+
public $_;
7+
public function __get($name) {
8+
global $obj;
9+
$obj->f =& $this->b - $x > $y = new StdClass;
10+
static $a = $a;
11+
$t = 'x';
12+
foreach (get_defined_vars() as $key => $e) {}
13+
if ($v ==!1) $x = $a ?: $t = "ok";
14+
}
15+
}
16+
$rc = new ReflectionClass(A::class);
17+
$obj = $rc->newLazyProxy(function () { return new A; });
18+
$real = $rc->initializeLazyObject($obj);
19+
var_dump($real->prop);
20+
?>
21+
--EXPECTF--
22+
Deprecated: Creation of dynamic property A::$b is deprecated in %s on line %d
23+
24+
Deprecated: Creation of dynamic property A::$f is deprecated in %s on line %d
25+
26+
Warning: Undefined variable $x in %s on line %d
27+
28+
Notice: Object of class stdClass could not be converted to int in %s on line %d
29+
30+
Warning: Undefined variable $a in %s on line %d
31+
32+
Warning: Undefined variable $v in %s on line %d
33+
34+
Notice: Indirect modification of overloaded property A::$b has no effect in %s on line %d
35+
36+
Warning: Undefined variable $x in %s on line %d
37+
38+
Notice: Object of class stdClass could not be converted to int in %s on line %d
39+
40+
Warning: Undefined variable $v in %s on line %d
41+
42+
Notice: Indirect modification of overloaded property A::$f has no effect in %s on line %d
43+
44+
Fatal error: Uncaught Error: Cannot assign by reference to overloaded object in %s:%d
45+
Stack trace:
46+
#0 %s(%d): A->__get('b')
47+
#1 %s(%d): A->__get('prop')
48+
#2 {main}
49+
thrown in %s on line %d

‎Zend/tests/lazy_objects/gh20875_proxy_get_no_init.phpt‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
--TEST--
2+
GH-20875 (Lazy proxy should not initialize when __get handles dynamic property access)
3+
--FILE--
4+
<?php
5+
6+
class Foo {
7+
public $_;
8+
9+
public function &__get($name) {
10+
echo "__get\n";
11+
return $name;
12+
}
13+
}
14+
15+
$proxy = (new ReflectionClass(Foo::class))->newLazyProxy(function () {
16+
echo "init\n";
17+
return new Foo();
18+
});
19+
$x = &$proxy->x;
20+
21+
?>
22+
--EXPECT--
23+
__get

‎Zend/zend_object_handlers.c‎

Lines changed: 34 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1405,12 +1405,24 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *nam
14051405
UNEXPECTED((*zend_get_property_guard(zobj, name)) & IN_GET) ||
14061406
UNEXPECTED(prop_info && (Z_PROP_FLAG_P(retval) & IS_PROP_UNINIT))) {
14071407
if (UNEXPECTED(zend_lazy_object_must_init(zobj) && (Z_PROP_FLAG_P(retval) & IS_PROP_LAZY))) {
1408-
zobj = zend_lazy_object_init(zobj);
1409-
if (!zobj) {
1408+
bool guarded = zobj->ce->__get
1409+
&& (*zend_get_property_guard(zobj, name) & IN_GET);
1410+
zend_object *instance = zend_lazy_object_init(zobj);
1411+
if (!instance) {
14101412
return &EG(error_zval);
14111413
}
14121414

1413-
return zend_std_get_property_ptr_ptr(zobj, name, type, cache_slot);
1415+
if (guarded && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
1416+
uint32_t *guard = zend_get_property_guard(instance, name);
1417+
if (!(*guard & IN_GET)) {
1418+
(*guard) |= IN_GET;
1419+
retval = zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1420+
(*guard) &= ~IN_GET;
1421+
return retval;
1422+
}
1423+
}
1424+
1425+
return zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
14141426
}
14151427
if (UNEXPECTED(type == BP_VAR_RW || type == BP_VAR_R)) {
14161428
if (prop_info) {
@@ -1453,6 +1465,25 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *nam
14531465
}
14541466
if (EXPECTED(!zobj->ce->__get) ||
14551467
UNEXPECTED((*zend_get_property_guard(zobj, name)) & IN_GET)) {
1468+
if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1469+
bool guarded = (zobj->ce->__get != NULL);
1470+
zend_object *instance = zend_lazy_object_init(zobj);
1471+
if (!instance) {
1472+
return &EG(error_zval);
1473+
}
1474+
1475+
if (guarded && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
1476+
uint32_t *guard = zend_get_property_guard(instance, name);
1477+
if (!(*guard & IN_GET)) {
1478+
(*guard) |= IN_GET;
1479+
retval = zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1480+
(*guard) &= ~IN_GET;
1481+
return retval;
1482+
}
1483+
}
1484+
1485+
return zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1486+
}
14561487
if (UNEXPECTED(zobj->ce->ce_flags & ZEND_ACC_NO_DYNAMIC_PROPERTIES)) {
14571488
zend_forbidden_dynamic_property(zobj->ce, name);
14581489
return &EG(error_zval);
@@ -1462,14 +1493,6 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *nam
14621493
return &EG(error_zval);
14631494
}
14641495
}
1465-
if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1466-
zobj = zend_lazy_object_init(zobj);
1467-
if (!zobj) {
1468-
return &EG(error_zval);
1469-
}
1470-
1471-
return zend_std_get_property_ptr_ptr(zobj, name, type, cache_slot);
1472-
}
14731496
if (UNEXPECTED(!zobj->properties)) {
14741497
rebuild_object_properties_internal(zobj);
14751498
}

0 commit comments

Comments
 (0)