Skip to content

Commit 07aa7bc

Browse files
iliaaliliaal
committed
Fix GH-20875: Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies
zend_std_get_property_ptr_ptr() was the only property handler that did not propagate the IN_GET guard to the underlying object when forwarding from a lazy proxy after initialization. This caused __get to be called on the underlying object when it shouldn't be, leading to assertion failures. The same guard-copying pattern already existed in read_property, write_property, unset_property, and has_property since commit 26f5009 (GH-18039). Also fixes GH-20873 and GH-20854. Closes GH-20875
1 parent 8cf9179 commit 07aa7bc

4 files changed

Lines changed: 140 additions & 6 deletions

File tree

‎Zend/tests/lazy_objects/gh20854.phpt‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
--TEST--
2+
GH-20854 (Assertion in ZEND_RETURN_BY_REF with lazy proxy and return-by-ref __get)
3+
--FILE--
4+
<?php
5+
class C {
6+
public $prop;
7+
8+
function &__get($name) {
9+
return $this->x;
10+
}
11+
}
12+
13+
$rc = new ReflectionClass(C::class);
14+
$obj = $rc->newLazyProxy(function () {
15+
return new C;
16+
});
17+
$obj->x;
18+
echo "Done\n";
19+
?>
20+
--EXPECTF--
21+
Deprecated: Creation of dynamic property C::$x is deprecated in %s on line %d
22+
23+
Deprecated: Creation of dynamic property C::$x is deprecated in %s on line %d
24+
Done

‎Zend/tests/lazy_objects/gh20873.phpt‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
--TEST--
2+
GH-20873 (Assertion failure in _zendi_try_convert_scalar_to_number with lazy proxy)
3+
--FILE--
4+
<?php
5+
class A {
6+
public $_;
7+
public function __get($n) {
8+
global $obj;
9+
$obj->x =& $this->_;
10+
static $a = $a;
11+
$e =& $this->_ - $a;
12+
}
13+
}
14+
$rc = new ReflectionClass(A::class);
15+
$obj = $rc->newLazyProxy(fn() => new A);
16+
$rc->initializeLazyObject($obj);
17+
var_dump($obj->p);
18+
?>
19+
--EXPECTF--
20+
Deprecated: Creation of dynamic property A::$x is deprecated in %s on line %d
21+
22+
Deprecated: Creation of dynamic property A::$x is deprecated in %s on line %d
23+
24+
Warning: Undefined variable $a in %s on line %d
25+
26+
Notice: Indirect modification of overloaded property A::$x has no effect in %s on line %d
27+
28+
Fatal error: Uncaught Error: Cannot assign by reference to overloaded object in %s:%d
29+
Stack trace:
30+
#0 %s(%d): A->__get('p')
31+
#1 {main}
32+
thrown in %s on line %d

‎Zend/tests/lazy_objects/gh20875.phpt‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
--TEST--
2+
GH-20875 (Assertion failure in _get_zval_ptr_tmp with lazy proxy)
3+
--FILE--
4+
<?php
5+
class A {
6+
public $_;
7+
public function __get($name) {
8+
global $obj;
9+
$obj->f =& $this->b - $x > $y = new StdClass;
10+
static $a = $a;
11+
$t = 'x';
12+
foreach (get_defined_vars() as $key => $e) {}
13+
if ($v ==!1) $x = $a ?: $t = "ok";
14+
}
15+
}
16+
$rc = new ReflectionClass(A::class);
17+
$obj = $rc->newLazyProxy(function () { return new A; });
18+
$real = $rc->initializeLazyObject($obj);
19+
var_dump($real->prop);
20+
?>
21+
--EXPECTF--
22+
Deprecated: Creation of dynamic property A::$b is deprecated in %s on line %d
23+
24+
Deprecated: Creation of dynamic property A::$b is deprecated in %s on line %d
25+
26+
Deprecated: Creation of dynamic property A::$f is deprecated in %s on line %d
27+
28+
Deprecated: Creation of dynamic property A::$f is deprecated in %s on line %d
29+
30+
Warning: Undefined variable $x in %s on line %d
31+
32+
Notice: Object of class stdClass could not be converted to int in %s on line %d
33+
34+
Warning: Undefined variable $a in %s on line %d
35+
36+
Warning: Undefined variable $v in %s on line %d
37+
38+
Notice: Indirect modification of overloaded property A::$b has no effect in %s on line %d
39+
40+
Deprecated: Creation of dynamic property A::$f is deprecated in %s on line %d
41+
42+
Warning: Undefined variable $x in %s on line %d
43+
44+
Notice: Object of class stdClass could not be converted to int in %s on line %d
45+
46+
Warning: Undefined variable $v in %s on line %d
47+
48+
Notice: Indirect modification of overloaded property A::$f has no effect in %s on line %d
49+
50+
Fatal error: Uncaught Error: Cannot assign by reference to overloaded object in %s:%d
51+
Stack trace:
52+
#0 %s(%d): A->__get('b')
53+
#1 %s(%d): A->__get('prop')
54+
#2 {main}
55+
thrown in %s on line %d

‎Zend/zend_object_handlers.c‎

Lines changed: 29 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1409,12 +1409,24 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *nam
14091409
UNEXPECTED((*zend_get_property_guard(zobj, name)) & IN_GET) ||
14101410
UNEXPECTED(prop_info && (Z_PROP_FLAG_P(retval) & IS_PROP_UNINIT))) {
14111411
if (UNEXPECTED(zend_lazy_object_must_init(zobj) && (Z_PROP_FLAG_P(retval) & IS_PROP_LAZY))) {
1412-
zobj = zend_lazy_object_init(zobj);
1413-
if (!zobj) {
1412+
bool guarded = zobj->ce->__get
1413+
&& (*zend_get_property_guard(zobj, name) & IN_GET);
1414+
zend_object *instance = zend_lazy_object_init(zobj);
1415+
if (!instance) {
14141416
return &EG(error_zval);
14151417
}
14161418

1417-
return zend_std_get_property_ptr_ptr(zobj, name, type, cache_slot);
1419+
if (guarded && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
1420+
uint32_t *guard = zend_get_property_guard(instance, name);
1421+
if (!(*guard & IN_GET)) {
1422+
(*guard) |= IN_GET;
1423+
retval = zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1424+
(*guard) &= ~IN_GET;
1425+
return retval;
1426+
}
1427+
}
1428+
1429+
return zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
14181430
}
14191431
if (UNEXPECTED(type == BP_VAR_RW)) {
14201432
if (prop_info) {
@@ -1467,12 +1479,23 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *nam
14671479
}
14681480
}
14691481
if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1470-
zobj = zend_lazy_object_init(zobj);
1471-
if (!zobj) {
1482+
bool guarded = (zobj->ce->__get != NULL);
1483+
zend_object *instance = zend_lazy_object_init(zobj);
1484+
if (!instance) {
14721485
return &EG(error_zval);
14731486
}
14741487

1475-
return zend_std_get_property_ptr_ptr(zobj, name, type, cache_slot);
1488+
if (guarded && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
1489+
uint32_t *guard = zend_get_property_guard(instance, name);
1490+
if (!(*guard & IN_GET)) {
1491+
(*guard) |= IN_GET;
1492+
retval = zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1493+
(*guard) &= ~IN_GET;
1494+
return retval;
1495+
}
1496+
}
1497+
1498+
return zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
14761499
}
14771500
if (UNEXPECTED(!zobj->properties)) {
14781501
rebuild_object_properties_internal(zobj);

0 commit comments

Comments
 (0)