diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2018-06-22 12:58:48 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2018-06-25 15:04:09 +0200 |
| commit | 2543e61aed67add7522e0b4cdf9a13cf3e441f6f (patch) | |
| tree | 35349a532edd97e52927275f2fe474979df614ec /ext/reflection/php_reflection.c | |
| parent | 102bcb5c05d91b5138c72df5b118b25c6f9ad383 (diff) | |
| download | php-git-2543e61aed67add7522e0b4cdf9a13cf3e441f6f.tar.gz | |
Fixed bug #76509
In PHP static properties are shared between inheriting classes,
unless they are explicitly overwritten. However, because this
functionality was implemented using reference, it was possible
to break the implementation by reassigning the static property
reference.
This is fixed by switching the implementation from using references
to using INDIRECTs, which cannot be affected by userland code.
Diffstat (limited to 'ext/reflection/php_reflection.c')
| -rw-r--r-- | ext/reflection/php_reflection.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c index 99fd4a7959..b816106e25 100644 --- a/ext/reflection/php_reflection.c +++ b/ext/reflection/php_reflection.c @@ -3795,6 +3795,7 @@ static void add_class_vars(zend_class_entry *ce, int statics, zval *return_value prop = NULL; if (statics && (prop_info->flags & ZEND_ACC_STATIC) != 0) { prop = &ce->default_static_members_table[prop_info->offset]; + ZVAL_DEINDIRECT(prop); } else if (!statics && (prop_info->flags & ZEND_ACC_STATIC) == 0) { prop = &ce->default_properties_table[OBJ_PROP_TO_NUM(prop_info->offset)]; } @@ -5503,6 +5504,7 @@ ZEND_METHOD(reflection_property, getValue) return; } member_p = &CE_STATIC_MEMBERS(intern->ce)[ref->prop.offset]; + ZVAL_DEINDIRECT(member_p); ZVAL_DEREF(member_p); ZVAL_COPY(return_value, member_p); } else { @@ -5570,6 +5572,7 @@ ZEND_METHOD(reflection_property, setValue) return; } variable_ptr = &CE_STATIC_MEMBERS(intern->ce)[ref->prop.offset]; + ZVAL_DEINDIRECT(variable_ptr); if (variable_ptr != value) { zval garbage; |