php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #72813 Segfault with __get returned by ref
Submitted: 2016-08-11 13:10 UTC Modified: 2016-08-12 08:20 UTC
From: smilimko at gmail dot com Assigned: laruence (profile)
Status: Closed Package: Class/Object related
PHP Version: 7.0.9 OS: Windows 10
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: smilimko at gmail dot com
New email:
PHP Version: OS:

 

 [2016-08-11 13:10 UTC] smilimko at gmail dot com
Description:
------------
I use PHP 7.0.4

When I run the script represented below I get the different result for versions 5.6.* and 7.0. If it is not a bug I would want to know what changes were made in PHP that may cause that different behavior. 

Test script:
---------------
class Test
{
    private $props = ['a' => 'text', 'b' => 1];

    public function &__get($prop)
    {
        return $this->props[$prop];
    }
    
    public function __set($prop, $value)
    {
        if ($prop === 'b') $value = [$value];
        $this->props[$prop] = $value;
    }
    
    public function getProperties()
    {
        return [$this->props];
    }
}

$obj = new Test;
$obj->b = $obj->b;
print_r($obj->getProperties());

Expected result:
----------------
Array
(
    [0] => Array
        (
            [a] => text
            [b] => Array
                (
                    [0] => 1
                )
        )
)

Actual result:
--------------
Array
(
    [0] => Array
        (
            [a] => text
            [b] => Array
 *RECURSION*
        )
)

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-08-12 07:55 UTC] laruence@php.net
-Status: Open +Status: Verified -Assigned To: +Assigned To: laruence
 [2016-08-12 07:55 UTC] laruence@php.net
actually, this leads to a uaf problem....
 [2016-08-12 08:20 UTC] laruence@php.net
-Summary: Different behavior for PHP 5.6.* and PHP 7.* when values are returned by ref. +Summary: Segfault with __get returned by ref
 [2016-08-12 08:41 UTC] laruence@php.net
Automatic comment on behalf of laruence@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=e03480bfabce62916d57013d27069e3f46fc7730
Log: Fixed bug #72813 (Segfault with __get returned by ref)
 [2016-08-12 08:41 UTC] laruence@php.net
-Status: Verified +Status: Closed
 [2016-10-17 10:10 UTC] bwoebi@php.net
Automatic comment on behalf of laruence@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=e03480bfabce62916d57013d27069e3f46fc7730
Log: Fixed bug #72813 (Segfault with __get returned by ref)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Dec 08 06:01:28 2024 UTC