- MFH: Fixed bug #48248 (SIGSEGV when access to private property via &__get)

2 files changed, 29 insertions, 2 deletions

diff --git a/Zend/tests/bug48248.phpt b/Zend/tests/bug48248.phpt
new file mode 100644
index 0000000000..9cdb7c1a00
--- /dev/null
+++ b/Zend/tests/bug48248.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Bug #48248 (SIGSEGV when access to private property via &__get)
+--FILE--
+<?php
+
+class A
+{
+    public function & __get($name)
+    {
+        return $this->test;
+    }
+}
+
+class B extends A
+{
+    private $test;
+}
+
+$b = new B;
+var_dump($b->test);
+
+?>
+--EXPECTF--
+Notice: Undefined property: B::$test in %s on line %d
+
+Notice: Only variable references should be returned by reference in %s on line %d
+NULL
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index 7050dfeca9..e04bcb1447 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -578,8 +578,8 @@ static zval **zend_std_get_property_ptr_ptr(zval *object, zval *member TSRMLS_DC
 		zend_guard *guard;
 
 		if (!zobj->ce->__get ||
-		    zend_get_property_guard(zobj, property_info, member, &guard) != SUCCESS ||
-		    guard->in_get) {
+			zend_get_property_guard(zobj, property_info, member, &guard) != SUCCESS ||
+			(property_info && guard->in_get)) {
 			/* we don't have access controls - will just add it */
 			new_zval = &EG(uninitialized_zval);