Skip to content

Commit 400cba2

Browse files
iliaaliliaal
committed
Fix GH-20875: Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies
zend_std_get_property_ptr_ptr() was the only property handler that did not propagate the IN_GET guard to the underlying object when forwarding from a lazy proxy after initialization. This caused __get to be called on the underlying object when it shouldn't be, leading to assertion failures. The same guard-copying pattern already existed in read_property, write_property, unset_property, and has_property since commit 26f5009 (GH-18039). Also fixes GH-20873 and GH-20854. Closes GH-20875
1 parent b97dd33 commit 400cba2

4 files changed

Lines changed: 140 additions & 6 deletions

File tree

‎Zend/tests/lazy_objects/gh20854.phpt‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
--TEST--
2+
GH-20854 (Assertion in ZEND_RETURN_BY_REF with lazy proxy and return-by-ref __get)
3+
--FILE--
4+
<?php
5+
class C {
6+
public $prop;
7+
8+
function &__get($name) {
9+
return $this->x;
10+
}
11+
}
12+
13+
$rc = new ReflectionClass(C::class);
14+
$obj = $rc->newLazyProxy(function () {
15+
return new C;
16+
});
17+
$obj->x;
18+
echo "Done\n";
19+
?>
20+
--EXPECTF--
21+
Deprecated: Creation of dynamic property C::$x is deprecated in %s on line %d
22+
23+
Deprecated: Creation of dynamic property C::$x is deprecated in %s on line %d
24+
Done

‎Zend/tests/lazy_objects/gh20873.phpt‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
--TEST--
2+
GH-20873 (Assertion failure in _zendi_try_convert_scalar_to_number with lazy proxy)
3+
--FILE--
4+
<?php
5+
class A {
6+
public $_;
7+
public function __get($n) {
8+
global $obj;
9+
$obj->x =& $this->_;
10+
static $a = $a;
11+
$e =& $this->_ - $a;
12+
}
13+
}
14+
$rc = new ReflectionClass(A::class);
15+
$obj = $rc->newLazyProxy(fn() => new A);
16+
$rc->initializeLazyObject($obj);
17+
var_dump($obj->p);
18+
?>
19+
--EXPECTF--
20+
Deprecated: Creation of dynamic property A::$x is deprecated in %s on line %d
21+
22+
Deprecated: Creation of dynamic property A::$x is deprecated in %s on line %d
23+
24+
Warning: Undefined variable $a in %s on line %d
25+
26+
Notice: Indirect modification of overloaded property A::$x has no effect in %s on line %d
27+
28+
Fatal error: Uncaught Error: Cannot assign by reference to overloaded object in %s:%d
29+
Stack trace:
30+
#0 %s(%d): A->__get('p')
31+
#1 {main}
32+
thrown in %s on line %d

‎Zend/tests/lazy_objects/gh20875.phpt‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
--TEST--
2+
GH-20875 (Assertion failure in _get_zval_ptr_tmp with lazy proxy)
3+
--FILE--
4+
<?php
5+
class A {
6+
public $_;
7+
public function __get($name) {
8+
global $obj;
9+
$obj->f =& $this->b - $x > $y = new StdClass;
10+
static $a = $a;
11+
$t = 'x';
12+
foreach (get_defined_vars() as $key => $e) {}
13+
if ($v ==!1) $x = $a ?: $t = "ok";
14+
}
15+
}
16+
$rc = new ReflectionClass(A::class);
17+
$obj = $rc->newLazyProxy(function () { return new A; });
18+
$real = $rc->initializeLazyObject($obj);
19+
var_dump($real->prop);
20+
?>
21+
--EXPECTF--
22+
Deprecated: Creation of dynamic property A::$b is deprecated in %s on line %d
23+
24+
Deprecated: Creation of dynamic property A::$b is deprecated in %s on line %d
25+
26+
Deprecated: Creation of dynamic property A::$f is deprecated in %s on line %d
27+
28+
Deprecated: Creation of dynamic property A::$f is deprecated in %s on line %d
29+
30+
Warning: Undefined variable $x in %s on line %d
31+
32+
Notice: Object of class stdClass could not be converted to int in %s on line %d
33+
34+
Warning: Undefined variable $a in %s on line %d
35+
36+
Warning: Undefined variable $v in %s on line %d
37+
38+
Notice: Indirect modification of overloaded property A::$b has no effect in %s on line %d
39+
40+
Deprecated: Creation of dynamic property A::$f is deprecated in %s on line %d
41+
42+
Warning: Undefined variable $x in %s on line %d
43+
44+
Notice: Object of class stdClass could not be converted to int in %s on line %d
45+
46+
Warning: Undefined variable $v in %s on line %d
47+
48+
Notice: Indirect modification of overloaded property A::$f has no effect in %s on line %d
49+
50+
Fatal error: Uncaught Error: Cannot assign by reference to overloaded object in %s:%d
51+
Stack trace:
52+
#0 %s(%d): A->__get('b')
53+
#1 %s(%d): A->__get('prop')
54+
#2 {main}
55+
thrown in %s on line %d

‎Zend/zend_object_handlers.c‎

Lines changed: 29 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1401,12 +1401,24 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *nam
14011401
UNEXPECTED((*zend_get_property_guard(zobj, name)) & IN_GET) ||
14021402
UNEXPECTED(prop_info && (Z_PROP_FLAG_P(retval) & IS_PROP_UNINIT))) {
14031403
if (UNEXPECTED(zend_lazy_object_must_init(zobj) && (Z_PROP_FLAG_P(retval) & IS_PROP_LAZY))) {
1404-
zobj = zend_lazy_object_init(zobj);
1405-
if (!zobj) {
1404+
bool guarded = zobj->ce->__get
1405+
&& (*zend_get_property_guard(zobj, name) & IN_GET);
1406+
zend_object *instance = zend_lazy_object_init(zobj);
1407+
if (!instance) {
14061408
return &EG(error_zval);
14071409
}
14081410

1409-
return zend_std_get_property_ptr_ptr(zobj, name, type, cache_slot);
1411+
if (guarded && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
1412+
uint32_t *guard = zend_get_property_guard(instance, name);
1413+
if (!(*guard & IN_GET)) {
1414+
(*guard) |= IN_GET;
1415+
retval = zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1416+
(*guard) &= ~IN_GET;
1417+
return retval;
1418+
}
1419+
}
1420+
1421+
return zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
14101422
}
14111423
if (UNEXPECTED(type == BP_VAR_RW || type == BP_VAR_R)) {
14121424
if (prop_info) {
@@ -1459,12 +1471,23 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *nam
14591471
}
14601472
}
14611473
if (UNEXPECTED(zend_lazy_object_must_init(zobj))) {
1462-
zobj = zend_lazy_object_init(zobj);
1463-
if (!zobj) {
1474+
bool guarded = (zobj->ce->__get != NULL);
1475+
zend_object *instance = zend_lazy_object_init(zobj);
1476+
if (!instance) {
14641477
return &EG(error_zval);
14651478
}
14661479

1467-
return zend_std_get_property_ptr_ptr(zobj, name, type, cache_slot);
1480+
if (guarded && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
1481+
uint32_t *guard = zend_get_property_guard(instance, name);
1482+
if (!(*guard & IN_GET)) {
1483+
(*guard) |= IN_GET;
1484+
retval = zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
1485+
(*guard) &= ~IN_GET;
1486+
return retval;
1487+
}
1488+
}
1489+
1490+
return zend_std_get_property_ptr_ptr(instance, name, type, cache_slot);
14681491
}
14691492
if (UNEXPECTED(!zobj->properties)) {
14701493
rebuild_object_properties_internal(zobj);

0 commit comments

Comments
 (0)