- Fixed bug #49074 (private class static fields can be modified by using reflection)

1 files changed, 8 insertions, 2 deletions

diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index d3cd28e8e0..66d61c7370 100644
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -3030,6 +3030,7 @@ ZEND_METHOD(reflection_class, getStaticProperties)
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
+	
 	GET_REFLECTION_OBJECT_PTR(ce);
 
 	zend_update_class_constants(ce TSRMLS_CC);
@@ -3045,12 +3046,17 @@ ZEND_METHOD(reflection_class, getStaticProperties)
 
 		if (zend_hash_get_current_key_ex(CE_STATIC_MEMBERS(ce), &key, &key_len, &num_index, 0, &pos) != FAILURE && key) {
 			char *prop_name, *class_name;
+			zval *prop_copy;
 
 			zend_unmangle_property_name(key, key_len-1, &class_name, &prop_name);
 
-			zval_add_ref(value);
+			/* copy: enforce read only access */
+			ALLOC_ZVAL(prop_copy);
+			*prop_copy = **value;
+			zval_copy_ctor(prop_copy);
+			INIT_PZVAL(prop_copy);
 
-			zend_hash_update(Z_ARRVAL_P(return_value), prop_name, strlen(prop_name)+1, value, sizeof(zval *), NULL);
+			add_assoc_zval(return_value, prop_name, prop_copy);
 		}
 		zend_hash_move_forward_ex(CE_STATIC_MEMBERS(ce), &pos);
 	}