Skip to content

Commit 0c6d903

Browse files
smalyshevsmalyshev
committed
fix bug #49348 - issue notice on get_property_ptr_ptr when used for read
1 parent 91538e4 commit 0c6d903

File tree

12 files changed

+213
-211
lines changed

12 files changed

+213
-211
lines changed

‎Zend/zend_closures.c

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
| Copyright (c) 1998-2013 Zend Technologies Ltd. (http://www.zend.com) |
66
+----------------------------------------------------------------------+
77
| This source file is subject to version 2.00 of the Zend license, |
8-
| that is bundled with this package in the file LICENSE, and is |
8+
| that is bundled with this package in the file LICENSE, and is |
99
| available through the world-wide-web at the following url: |
1010
| http://www.zend.com/license/2_00.txt. |
1111
| If you did not receive a copy of the Zend license and are unable to |
@@ -88,7 +88,7 @@ ZEND_METHOD(Closure, bind)
8888
RETURN_NULL();
8989
}
9090

91-
closure = (zend_closure *)zend_object_store_get_object(zclosure TSRMLS_CC);
91+
closure = (zend_closure *)zend_object_store_get_object(zclosure TSRMLS_CC);
9292

9393
if ((newthis != NULL) && (closure->func.common.fn_flags & ZEND_ACC_STATIC)) {
9494
zend_error(E_WARNING, "Cannot bind an instance to a static closure");
@@ -152,7 +152,7 @@ static int zend_closure_compare_objects(zval *o1, zval *o2 TSRMLS_DC) /* {{{ */
152152

153153
ZEND_API zend_function *zend_get_closure_invoke_method(zval *obj TSRMLS_DC) /* {{{ */
154154
{
155-
zend_closure *closure = (zend_closure *)zend_object_store_get_object(obj TSRMLS_CC);
155+
zend_closure *closure = (zend_closure *)zend_object_store_get_object(obj TSRMLS_CC);
156156
zend_function *invoke = (zend_function*)emalloc(sizeof(zend_function));
157157

158158
invoke->common = closure->func.common;
@@ -168,14 +168,14 @@ ZEND_API zend_function *zend_get_closure_invoke_method(zval *obj TSRMLS_DC) /* {
168168

169169
ZEND_API const zend_function *zend_get_closure_method_def(zval *obj TSRMLS_DC) /* {{{ */
170170
{
171-
zend_closure *closure = (zend_closure *)zend_object_store_get_object(obj TSRMLS_CC);
171+
zend_closure *closure = (zend_closure *)zend_object_store_get_object(obj TSRMLS_CC);
172172
return &closure->func;
173173
}
174174
/* }}} */
175175

176176
ZEND_API zval* zend_get_closure_this_ptr(zval *obj TSRMLS_DC) /* {{{ */
177177
{
178-
zend_closure *closure = (zend_closure *)zend_object_store_get_object(obj TSRMLS_CC);
178+
zend_closure *closure = (zend_closure *)zend_object_store_get_object(obj TSRMLS_CC);
179179
return closure->this_ptr;
180180
}
181181
/* }}} */
@@ -212,7 +212,7 @@ static void zend_closure_write_property(zval *object, zval *member, zval *value,
212212
}
213213
/* }}} */
214214

215-
static zval **zend_closure_get_property_ptr_ptr(zval *object, zval *member, const zend_literal *key TSRMLS_DC) /* {{{ */
215+
static zval **zend_closure_get_property_ptr_ptr(zval *object, zval *member, int type, const zend_literal *key TSRMLS_DC) /* {{{ */
216216
{
217217
ZEND_CLOSURE_PROPERTY_ERROR();
218218
return NULL;
@@ -378,7 +378,7 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp TSRMLS_
378378

379379
static HashTable *zend_closure_get_gc(zval *obj, zval ***table, int *n TSRMLS_DC) /* {{{ */
380380
{
381-
zend_closure *closure = (zend_closure *)zend_object_store_get_object(obj TSRMLS_CC);
381+
zend_closure *closure = (zend_closure *)zend_object_store_get_object(obj TSRMLS_CC);
382382

383383
*table = closure->this_ptr ? &closure->this_ptr : NULL;
384384
*n = closure->this_ptr ? 1 : 0;
@@ -474,7 +474,7 @@ ZEND_API void zend_create_closure(zval *res, zend_function *func, zend_class_ent
474474
zend_error(E_WARNING, "Cannot bind function %s::%s to scope class %s", func->common.scope->name, func->common.function_name, scope->name);
475475
scope = NULL;
476476
}
477-
if(scope && this_ptr && (func->common.fn_flags & ZEND_ACC_STATIC) == 0 &&
477+
if(scope && this_ptr && (func->common.fn_flags & ZEND_ACC_STATIC) == 0 &&
478478
!instanceof_function(Z_OBJCE_P(this_ptr), closure->func.common.scope TSRMLS_CC)) {
479479
zend_error(E_WARNING, "Cannot bind function %s::%s to object of class %s", func->common.scope->name, func->common.function_name, Z_OBJCE_P(this_ptr)->name);
480480
scope = NULL;

‎Zend/zend_execute.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1384,7 +1384,7 @@ static void zend_fetch_property_address(temp_variable *result, zval **container_
13841384
}
13851385

13861386
if (Z_OBJ_HT_P(container)->get_property_ptr_ptr) {
1387-
zval **ptr_ptr = Z_OBJ_HT_P(container)->get_property_ptr_ptr(container, prop_ptr, key TSRMLS_CC);
1387+
zval **ptr_ptr = Z_OBJ_HT_P(container)->get_property_ptr_ptr(container, prop_ptr, type, key TSRMLS_CC);
13881388
if (NULL == ptr_ptr) {
13891389
zval *ptr;
13901390

@@ -1523,9 +1523,9 @@ void zend_free_compiled_variables(zend_execute_data *execute_data) /* {{{ */
15231523
}
15241524
/* }}} */
15251525

1526-
/*
1526+
/*
15271527
* Stack Frame Layout (the whole stack frame is allocated at once)
1528-
* ==================
1528+
* ==================
15291529
*
15301530
* +========================================+
15311531
* | zend_execute_data |<---+

‎Zend/zend_object_handlers.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -714,7 +714,7 @@ static int zend_std_has_dimension(zval *object, zval *offset, int check_empty TS
714714
}
715715
/* }}} */
716716

717-
static zval **zend_std_get_property_ptr_ptr(zval *object, zval *member, const zend_literal *key TSRMLS_DC) /* {{{ */
717+
static zval **zend_std_get_property_ptr_ptr(zval *object, zval *member, int type, const zend_literal *key TSRMLS_DC) /* {{{ */
718718
{
719719
zend_object *zobj;
720720
zval tmp_member;
@@ -754,7 +754,9 @@ static zval **zend_std_get_property_ptr_ptr(zval *object, zval *member, const ze
754754
/* we don't have access controls - will just add it */
755755
new_zval = &EG(uninitialized_zval);
756756

757-
/* zend_error(E_NOTICE, "Undefined property: %s", Z_STRVAL_P(member)); */
757+
if(UNEXPECTED(type == BP_VAR_RW || type == BP_VAR_R)) {
758+
zend_error(E_NOTICE, "Undefined property: %s", Z_STRVAL_P(member));
759+
}
758760
Z_ADDREF_P(new_zval);
759761
if (EXPECTED((property_info->flags & ZEND_ACC_STATIC) == 0) &&
760762
property_info->offset >= 0) {

‎Zend/zend_object_handlers.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ typedef void (*zend_object_write_dimension_t)(zval *object, zval *offset, zval *
5050

5151

5252
/* Used to create pointer to the property of the object, for future direct r/w access */
53-
typedef zval **(*zend_object_get_property_ptr_ptr_t)(zval *object, zval *member, const struct _zend_literal *key TSRMLS_DC);
53+
typedef zval **(*zend_object_get_property_ptr_ptr_t)(zval *object, zval *member, int type, const struct _zend_literal *key TSRMLS_DC);
5454

5555
/* Used to set object value. Can be used to override assignments and scalar
5656
write ops (like ++, +=) on the object */

‎Zend/zend_vm_def.h

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -363,7 +363,7 @@ ZEND_VM_HELPER_EX(zend_binary_assign_op_obj_helper, VAR|UNUSED|CV, CONST|TMP|VAR
363363
/* here property is a string */
364364
if (opline->extended_value == ZEND_ASSIGN_OBJ
365365
&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
366-
zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
366+
zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
367367
if (zptr != NULL) { /* NULL means no success in getting PTR */
368368
SEPARATE_ZVAL_IF_NOT_REF(zptr);
369369

@@ -625,7 +625,7 @@ ZEND_VM_HELPER_EX(zend_pre_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR|
625625
}
626626

627627
if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
628-
zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
628+
zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
629629
if (zptr != NULL) { /* NULL means no success in getting PTR */
630630
SEPARATE_ZVAL_IF_NOT_REF(zptr);
631631

@@ -726,7 +726,7 @@ ZEND_VM_HELPER_EX(zend_post_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR
726726
}
727727

728728
if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
729-
zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
729+
zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
730730
if (zptr != NULL) { /* NULL means no success in getting PTR */
731731
have_get_ptr = 1;
732732
SEPARATE_ZVAL_IF_NOT_REF(zptr);
@@ -5411,7 +5411,7 @@ ZEND_VM_HANDLER(162, ZEND_FAST_CALL, ANY, ANY)
54115411
USE_OPLINE
54125412

54135413
if (opline->extended_value &&
5414-
UNEXPECTED(EG(prev_exception) != NULL)) {
5414+
UNEXPECTED(EG(prev_exception) != NULL)) {
54155415
/* in case of unhandled exception jump to catch block instead of finally */
54165416
ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->op2.opline_num]);
54175417
ZEND_VM_CONTINUE();

0 commit comments

Comments
 (0)