php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #64741 Various ways to reassign this
Submitted: 2013-04-30 11:42 UTC Modified: 2013-10-15 11:54 UTC
From: php dot bugs at daverandom dot com Assigned:
Status: No Feedback Package: Scripting Engine problem
PHP Version: Irrelevant OS: Any
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2013-04-30 11:42 UTC] php dot bugs at daverandom dot com
Description:
------------
The engine prevents userland code from directly reassigning $this with a compile 
time error, but it does not prevent a number of other mechanisms. The following 
are all possible:

    unset($this);

    // ...

    public function test()
    {
        ${'th'.'is'} = 'foo';
    }

    // ...

    public function test()
    {
        $foo = 'this';
        $$foo = 'foo';
    }

    // ...

    function ref(&$arg)
    {
        $arg = 'foo';
    }

    public function test()
    {
        ref($this);
    }


Test script:
---------------
<?php

    function ref(&$arg)
    {
        $arg = 'foo';
    }

    class ThisReassignments
    {
        public function test1() { var_dump($this); ${'th'.'is'} = 'foo'; var_dump($this); }
        public function test2() { var_dump($this); $foo = 'this'; $$foo = 'foo';; var_dump($this); }
        public function test3() { var_dump($this); ref($this); var_dump($this); }
    }

    (new ThisReassignments)->test1();
    (new ThisReassignments)->test2();
    (new ThisReassignments)->test3();

     // NB: unset() causes a segmentation fault and doesn't *really* work, but it should emit a meaningful error

Expected result:
----------------
Fatal error with a meaningful error message in all cases

Actual result:
--------------
object(ThisReassignments)#1 (0) {
}
string(3) "foo"
object(ThisReassignments)#1 (0) {
}
string(3) "foo"
object(ThisReassignments)#1 (0) {
}
string(3) "foo"


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2013-04-30 11:52 UTC] johannes@php.net
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

we prevent from mistakes, we don't prevent people from shooting in their feed, especially as such checks would slow down *all* variable access.
 [2013-04-30 11:52 UTC] johannes@php.net
-Status: Open +Status: Not a bug
 [2013-05-01 10:01 UTC] php dot bugs at daverandom dot com
I accept that the bulk of the examples below are difficult/impossible to prevent 
with the static analysis that happens at compile time, given the range of 
dynamic ways to do this that makes PHP a great language. I too would not like to 
see PEBKAC prevention affecting performance.

However, I think there is one example above that warrants further inspection: 
unset($this) actually causes a segfault (this can be seen here: 
http://codepad.viper-7.com/NX7v1q) and should be detectable at compile time 
fairly easily/inexpensively I would have thought, although I'm no expert on the 
PHP src.
 [2013-05-03 15:28 UTC] nikic@php.net
I am not able to reproduce the unset($this) segfault. Could you provide some more information regarding the used PHP version and ./configure?
 [2013-05-03 15:28 UTC] nikic@php.net
-Status: Not a bug +Status: Feedback
 [2013-10-15 11:54 UTC] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
 
PHP Copyright © 2001-2022 The PHP Group
All rights reserved.
Last updated: Mon Nov 28 11:05:53 2022 UTC