php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #67294 Operation performed on wrong property during interaction with an error handler
Submitted: 2014-05-16 19:54 UTC Modified: 2015-08-27 20:22 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:0 (0.0%)
From: pmoroney at name dot com Assigned: nikic (profile)
Status: Closed Package: Scripting Engine problem
PHP Version: Irrelevant OS: Linux
Private report: No CVE-ID: None
 [2014-05-16 19:54 UTC] pmoroney at name dot com
Description:
------------
When an error handler is called because of a undefined property and the error handler references a different object property that doesn't exist, even in an isset(), the original property gets replaced by the new property in the operation that was being performed.

I ran a git bisect to find the commit that introduced the error and found the following commit:
commit 0c6d903ce7615a7197cb997d67d98058c3ec5d6a
Author: Stanislav Malyshev <stas@php.net>
Date:   Mon Feb 18 20:56:02 2013 -0800

    fix bug #49348 - issue notice on get_property_ptr_ptr when used for read


Test script:
---------------
<?php
function err_handler()
{
      $s = new StdClass();
      isset($s->bad);
}

set_error_handler('err_handler');

$f->good += 5 ; 

var_export($f);

if(isset($f->bad))
    exit(1);
else
    exit(0);


Expected result:
----------------
stdClass::__set_state(array(
   'bad' => 5,
))

With an Exit value of 1

Actual result:
--------------
stdClass::__set_state(array(
   'good' => 5,
))

With an Exit value of 0

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2014-05-16 20:02 UTC] pmoroney at name dot com
It looks like I swapped my expected and actual results, sorry.
 [2014-05-27 17:36 UTC] pmoroney at name dot com
-PHP Version: master-Git-2014-05-16 (Git) +PHP Version: Irrelevant
 [2014-05-27 17:36 UTC] pmoroney at name dot com
After looking into that commit, it is obvious why that is the first time that this bug occurred, the error handler wasn't triggered previous to this commit in the case of a undefined property. I'm wondering if there is some reference to the property name that is being modified outside of the correct scope.
 [2015-08-27 20:22 UTC] nikic@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: nikic
 [2015-08-27 20:22 UTC] nikic@php.net
This has been fixed in 5.5.19 / 5.6.3 as part of bug #68118: https://3v4l.org/ucnDH
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Dec 21 16:01:28 2024 UTC