MFH

2 files changed, 147 insertions, 4 deletions

diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index d47d680549..ac755ea61d 100644
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -1142,14 +1142,19 @@ static void reflection_property_factory(zend_class_entry *ce, zend_property_info
 
 	if (!(prop->flags & ZEND_ACC_PRIVATE)) {
 		/* we have to search the class hierarchy for this (implicit) public or protected property */
-		zend_class_entry *tmp_ce = ce;
-		zend_property_info *tmp_info;
-		
+		zend_class_entry *tmp_ce = ce, *store_ce = ce;
+		zend_property_info *tmp_info = NULL;
+
 		while (tmp_ce && zend_hash_find(&tmp_ce->properties_info, prop_name, strlen(prop_name) + 1, (void **) &tmp_info) != SUCCESS) {
 			ce = tmp_ce;
-			prop = tmp_info;
 			tmp_ce = tmp_ce->parent;
 		}
+
+		if (tmp_info && !(tmp_info->flags & ZEND_ACC_SHADOW)) { /* found something and it's not a parent's private */
+			prop = tmp_info;
+		} else { /* not found, use initial value */
+			ce = store_ce;
+		}
 	}
 
 	MAKE_STD_ZVAL(name);
diff --git a/ext/reflection/tests/bug40431.phpt b/ext/reflection/tests/bug40431.phpt
new file mode 100644
index 0000000000..6e6e4c5eb1
--- /dev/null
+++ b/ext/reflection/tests/bug40431.phpt
@@ -0,0 +1,138 @@
+--TEST--
+Bug #40431 (dynamic properties may cause crash in ReflectionProperty methods)
+--FILE--
+<?php
+
+echo "=== 1st test ===\n";
+
+$Obj->value = 'value';
+$RefObj = new ReflectionObject($Obj);
+
+$props = $RefObj->getProperties();
+
+var_dump($props);
+var_dump($props[0]->isStatic());
+var_dump($props[0]->isPrivate());
+var_dump($props[0]->isPublic());
+var_dump($props[0]->isProtected());
+
+echo "=== 2nd test ===\n";
+
+class test1 {
+}
+
+class test2 extends test1{
+}
+
+$Obj = new test2;
+$Obj->value = 'value';
+$RefObj = new ReflectionObject($Obj);
+
+$props = $RefObj->getProperties();
+
+var_dump($props);
+var_dump($props[0]->isStatic());
+var_dump($props[0]->isPrivate());
+var_dump($props[0]->isPublic());
+var_dump($props[0]->isProtected());
+
+echo "=== 3rd test ===\n";
+
+class test3 {
+}
+
+$Obj = new test3;
+$Obj->value = 'value';
+$RefObj = new ReflectionObject($Obj);
+
+$props = $RefObj->getProperties();
+
+var_dump($props);
+var_dump($props[0]->isStatic());
+var_dump($props[0]->isPrivate());
+var_dump($props[0]->isPublic());
+var_dump($props[0]->isProtected());
+
+echo "=== 4th test ===\n";
+
+class test5 {
+	private $value = 1;
+}
+
+class test4 extends test5{
+}
+
+$Obj = new test4;
+$Obj->value = 'value';
+$RefObj = new ReflectionObject($Obj);
+
+$props = $RefObj->getProperties();
+
+var_dump($props);
+var_dump($props[0]->isStatic());
+var_dump($props[0]->isPrivate());
+var_dump($props[0]->isPublic());
+var_dump($props[0]->isProtected());
+
+echo "Done\n";
+?>
+--EXPECTF--	
+=== 1st test ===
+
+Strict Standards: Creating default object from empty value in %s on line %d
+array(1) {
+  [0]=>
+  &object(ReflectionProperty)#%d (2) {
+    ["name"]=>
+    string(5) "value"
+    ["class"]=>
+    string(8) "stdClass"
+  }
+}
+bool(false)
+bool(false)
+bool(true)
+bool(false)
+=== 2nd test ===
+array(1) {
+  [0]=>
+  &object(ReflectionProperty)#%d (2) {
+    ["name"]=>
+    string(5) "value"
+    ["class"]=>
+    string(5) "test2"
+  }
+}
+bool(false)
+bool(false)
+bool(true)
+bool(false)
+=== 3rd test ===
+array(1) {
+  [0]=>
+  &object(ReflectionProperty)#%d (2) {
+    ["name"]=>
+    string(5) "value"
+    ["class"]=>
+    string(5) "test3"
+  }
+}
+bool(false)
+bool(false)
+bool(true)
+bool(false)
+=== 4th test ===
+array(1) {
+  [0]=>
+  &object(ReflectionProperty)#%d (2) {
+    ["name"]=>
+    string(5) "value"
+    ["class"]=>
+    string(5) "test4"
+  }
+}
+bool(false)
+bool(false)
+bool(true)
+bool(false)
+Done