php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #45622 isset($arrayObject->p) misbehaves with ArrayObject::ARRAY_AS_PROPS set
Submitted: 2008-07-25 08:59 UTC Modified: 2008-07-26 13:24 UTC
From: robin_fernandes at uk dot ibm dot com Assigned:
Status: Closed Package: SPL related
PHP Version: 5.3CVS-2008-07-25 (CVS) OS: all
Private report: No CVE-ID:
 [2008-07-25 08:59 UTC] robin_fernandes at uk dot ibm dot com
Description:
------------
If an instance of ArrayObject $ao has flag ArrayObject::ARRAY_AS_PROPS set, $ao->p will access element p of the underlying storage array - but only if no real property p exists on $ao. If a real property p does exist, it will access that property as if the flag were not set.

This works correctly with read, write and unset, but not with isset:
when a real property p exists, isset($ao->p) always returns false .

Reproduce code:
---------------
<?php
class C extends ArrayObject {
	public $p = 'object property';
}	

$ao = new C(array('p'=>'array element'));
$ao->setFlags(ArrayObject::ARRAY_AS_PROPS);

echo "\n--> Access the real property:\n";
var_dump(isset($ao->p));  // bug
var_dump($ao->p);

echo "\n--> Remove the real property and access the array element:\n";
unset($ao->p);
var_dump(isset($ao->p));
var_dump($ao->p);

echo "\n--> Remove the array element and try access again:\n";
unset($ao->p);
var_dump(isset($ao->p));
var_dump($ao->p);
?>

Expected result:
----------------
--> Access the real property:
bool(true)
string(15) "object property"

--> Remove the real property and access the array element:
bool(true)
string(13) "array element"

--> Remove the array element and try access again:
bool(false)

Notice: Undefined index:  p in %s on line 21
NULL

Actual result:
--------------
--> Access the real property:
bool(false)
string(15) "object property"

--> Remove the real property and access the array element:
bool(true)
string(13) "array element"

--> Remove the array element and try access again:
bool(false)

Notice: Undefined index:  p in %s on line 21
NULL

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-07-25 09:01 UTC] robin_fernandes at uk dot ibm dot com
The bug is due to an erroneous return 0 in spl_array_has_property:

	if ((intern->ar_flags & SPL_ARRAY_ARRAY_AS_PROPS) != 0) {
		if (!std_object_handlers.has_property(object, member, 2 TSRMLS_CC)) {
			return spl_array_has_dimension(object, member, has_set_exists TSRMLS_CC);
		}
		return 0; /* if prop doesn't exist at all mode 0/1 cannot return 1 */
	}

The comment states we return 0 when "prop doesn't exist at all", but the previous condition is such that this branch will be taken specifically if the property DOES exist.

Here's a simple patch against 5_3: http://pastebin.ca/1082412
 [2008-07-26 13:24 UTC] lbarnaud@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.

Fxied, thanks :) 
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Wed Apr 23 09:02:23 2014 UTC