php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #60475 Assignments of $this in some implicit __toString contexts get broken
Submitted: 2011-12-08 16:58 UTC Modified: 2017-01-02 14:13 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: ctrahey at rubicon dot com Assigned: nikic (profile)
Status: Closed Package: Class/Object related
PHP Version: 5.3.8, 5.4.0RC2, 5.5.0-dev OS: Windows 7, Ubuntu 10
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please !
Your email address:
MUST BE VALID
Solve the problem:
50 - 22 = ?
Subscribe to this entry?

 
 [2011-12-08 16:58 UTC] ctrahey at rubicon dot com
Description:
------------
Tested with php 5.3.8 on Windows 7, 5.4.0RC2 Win32, and 5.4.0RC2 (cli) on Ubuntu 10.04.3

When an object is implicitly used as a string when passed to some php functions, __toString is called as expected, but any assignments of $this from within __toString are eventually broken and point instead to the string that gets returned. This behavior occurs only in some php functions, and never if you cast as string while passing into the functions.

This behavior has been observed when passing objects into at least these php functions:
str_replace, preg_replace, preg_match_all, sprintf.

There are many php string functions that do not behave this way (they allow __toString-created references to $this persist as references to the object).

For extra fun, play around with htmlspecialchars, echo-ing the output... I suspect that's a whole different issue, but related (possible memory leak there).


Test script:
---------------
<?php
class Primary {
 public function __toString() {
  $GLOBALS['anObject'] = $this;
  return 'toString output from Primary';
 }
}
$Foo = new Primary;
str_replace('', '', $Foo);
var_dump($GLOBALS['anObject']); 
// expected to be object of class Primary, actually string

Expected result:
----------------
object(Primary)#1 (0) { } 

Actual result:
--------------
string(28) "toString output from Primary" 

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-12-12 18:25 UTC] ctrahey at rubicon dot com
-PHP Version: 5.3.8 +PHP Version: 5.3.8, 5.4.0RC2, 5.5.0-dev
 [2011-12-12 18:25 UTC] ctrahey at rubicon dot com
Tested against trunk (5.5.0-dev, revision 320923) compiled on Ubuntu 10.04.3 with same (incorrect) result.
 [2014-01-22 11:30 UTC] joe dot bowman at edigitalresearch dot com
This issue can be replicated in PHP version 5.4.19 and 5.5.3 (via php-fpm) on Centos 6.4, specifically passing Objects into in_array (object has a __toString() method, and is being compared to an array of strings).
 [2015-07-07 21:19 UTC] cmb@php.net
The issue appears to be resolved in PHP 7: <http://3v4l.org/D7nhN>.
 [2017-01-02 14:13 UTC] nikic@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: nikic
 [2017-01-02 14:13 UTC] nikic@php.net
Closing as the bug has been fixed in PHP 7.0 and PHP 5.6 is going out of active support.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Tue May 21 14:01:33 2024 UTC