php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #72813 Segfault with __get returned by ref
Submitted: 2016-08-11 13:10 UTC Modified: 2016-08-12 08:20 UTC
From: smilimko at gmail dot com Assigned: laruence
Status: Closed Package: Class/Object related
PHP Version: 7.0.9 OS: Windows 10
Private report: No CVE-ID:
 [2016-08-11 13:10 UTC] smilimko at gmail dot com
Description:
------------
I use PHP 7.0.4

When I run the script represented below I get the different result for versions 5.6.* and 7.0. If it is not a bug I would want to know what changes were made in PHP that may cause that different behavior. 

Test script:
---------------
class Test
{
    private $props = ['a' => 'text', 'b' => 1];

    public function &__get($prop)
    {
        return $this->props[$prop];
    }
    
    public function __set($prop, $value)
    {
        if ($prop === 'b') $value = [$value];
        $this->props[$prop] = $value;
    }
    
    public function getProperties()
    {
        return [$this->props];
    }
}

$obj = new Test;
$obj->b = $obj->b;
print_r($obj->getProperties());

Expected result:
----------------
Array
(
    [0] => Array
        (
            [a] => text
            [b] => Array
                (
                    [0] => 1
                )
        )
)

Actual result:
--------------
Array
(
    [0] => Array
        (
            [a] => text
            [b] => Array
 *RECURSION*
        )
)

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-08-12 07:55 UTC] laruence@php.net
-Status: Open +Status: Verified -Assigned To: +Assigned To: laruence
 [2016-08-12 07:55 UTC] laruence@php.net
actually, this leads to a uaf problem....
 [2016-08-12 08:20 UTC] laruence@php.net
-Summary: Different behavior for PHP 5.6.* and PHP 7.* when values are returned by ref. +Summary: Segfault with __get returned by ref
 [2016-08-12 08:41 UTC] laruence@php.net
Automatic comment on behalf of laruence@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=e03480bfabce62916d57013d27069e3f46fc7730
Log: Fixed bug #72813 (Segfault with __get returned by ref)
 [2016-08-12 08:41 UTC] laruence@php.net
-Status: Verified +Status: Closed
 [2016-10-17 10:10 UTC] bwoebi@php.net
Automatic comment on behalf of laruence@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=e03480bfabce62916d57013d27069e3f46fc7730
Log: Fixed bug #72813 (Segfault with __get returned by ref)
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Mon Feb 20 22:01:35 2017 UTC