- MFH Fixed Bug #37667 (Object is not added into array returned by __get)

4 files changed, 50 insertions, 3 deletions

diff --git a/Zend/tests/bug37667.phpt b/Zend/tests/bug37667.phpt
new file mode 100755
index 0000000000..429a9be3af
--- /dev/null
+++ b/Zend/tests/bug37667.phpt
@@ -0,0 +1,43 @@
+--TEST--
+Bug #37667 (Object is not added into array returned by __get)
+--FILE--
+<?php
+
+class Test
+{
+	protected $property = array('foo' => 'bar');
+
+	function __get($name)
+	{
+		return $this->property;
+	}
+}
+
+$obj = new Test;
+
+var_dump($obj->property['foo']);
+var_dump($obj->property[2]);
+
+var_dump($obj);
+
+$obj->property[] = 1;
+$obj->property[] = 2;
+
+var_dump($obj);
+
+?>
+===DONE===
+--EXPECTF--
+string(3) "bar"
+
+Notice: Undefined offset:  2 in %sbug37667.php on line %d
+NULL
+object(Test)#%d (1) {
+  ["property:protected"]=>
+  array(1) {
+    ["foo"]=>
+    string(3) "bar"
+  }
+}
+
+Fatal error: Cannot use array returned from Test::__get('property') in write context in %sbug37667.php on line %d
diff --git a/Zend/zend_exceptions.c b/Zend/zend_exceptions.c
index 6a7cf43bd5..84d1432601 100644
--- a/Zend/zend_exceptions.c
+++ b/Zend/zend_exceptions.c
@@ -435,7 +435,7 @@ ZEND_METHOD(exception, getTraceAsString)
 	char *res = estrdup(""), **str = &res, *s_tmp;
 	int res_len = 0, *len = &res_len, num = 0;
 
-	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
+	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, BP_VAR_R TSRMLS_CC);
 	zend_hash_apply_with_arguments(Z_ARRVAL_P(trace), (apply_func_args_t)_build_trace_string, 3, str, len, &num);
 
 	s_tmp = emalloc(1 + MAX_LENGTH_OF_LONG + 7 + 1);
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 99fb7ac7ad..9a05235f14 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -946,6 +946,7 @@ static inline zval **zend_fetch_dimension_address_inner(HashTable *ht, zval *dim
 			offset_key = "";
 			offset_key_length = 0;
 			goto fetch_string_dim;
+
 		case IS_STRING:
 			
 			offset_key = dim->value.str.val;
@@ -1266,7 +1267,7 @@ static void zend_fetch_property_address(temp_variable *result, zval **container_
 			zval *ptr;
 
 			if (Z_OBJ_HT_P(container)->read_property &&
-				(ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, BP_VAR_W TSRMLS_CC)) != NULL) {
+				(ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, type TSRMLS_CC)) != NULL) {
 				if (result) {
 					result->var.ptr = ptr;
 					result->var.ptr_ptr = &result->var.ptr;
@@ -1279,7 +1280,7 @@ static void zend_fetch_property_address(temp_variable *result, zval **container_
 		}
 	} else if (Z_OBJ_HT_P(container)->read_property) {
 		if (result) {
-			result->var.ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, BP_VAR_W TSRMLS_CC);
+			result->var.ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, type TSRMLS_CC);
 			result->var.ptr_ptr = &result->var.ptr;
 		}
 	} else {
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index f880d441ef..d3a52064fe 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -349,6 +349,9 @@ zval *zend_std_read_property(zval *object, zval *member, int type TSRMLS_DC)
 		zval_ptr_dtor(&tmp_member);
 		(*retval)->refcount--;
 	}
+	if (*retval && (type == BP_VAR_W || type == BP_VAR_RW) && Z_TYPE_PP(retval) == IS_ARRAY) {
+		zend_error(E_ERROR, "Cannot use array returned from %s::__get('%s') in write context", zobj->ce->name, Z_STRVAL_P(member));
+	}
 	return *retval;
 }