#44827 [Asn]: define('::') can be defined

 ID:               44827
 Updated by:       [email protected]
 Reported By:      [email protected]
 Status:           Assigned
 Bug Type:         Scripting Engine problem
 Operating System: *
 PHP Version:      5.*, 6CVS (2009-05-05)
 Assigned To:      iliaa
 New Comment:

Code in ZendEngine2/zend_builtin_functions.c revision
1.277.2.12.2.25.2.52 checks if the class exists and creates the global
constant with the name A::B if it does. But this constant is unreachable
other than by get_defined_constants() because both constant("A::B") and
A::B works with class constants.

<?php
class A {}
define("A::B", true);
echo constant("A::B"); // Fatal error: Undefined class constant 'B'
echo A::B; // Fatal error: Undefined class constant 'B'
?>

I suggest to issue an error if the constant name contains "::"
regardless the class exists or not. The code would be even simpler.


Previous Comments:
------------------------------------------------------------------------

[2009-06-08 13:10:06] [email protected]

Reopened.
Patches for HEAD and 5_2 broke the build and have been reverted.

------------------------------------------------------------------------

[2009-06-08 01:27:17] [email protected]

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.



------------------------------------------------------------------------

[2008-10-25 21:18:41] [email protected]

now that namespace separator will be \, the fix is simple: grep for
"::" and fail if a user tries to do it.

------------------------------------------------------------------------

[2008-04-25 10:11:39] [email protected]

As a note to this while we're at define().

define() also seems to ignore if you declare a class constant like:
define('test::c', 'test');

Both with and without having a class called 'test' passes this, testing
without the class 'test' like:
var_dump(test::c);

Will result in a fatal error: class 'test' not found. Testing it with a
class called 'test' will issue a fatal error: undefined class constant
'c'.

If the class 'test' already have a constant called 'c' define() will
still ignore it and var_dump() will return the real value of test::c.

------------------------------------------------------------------------

[2008-04-25 10:01:38] [email protected]

Description:
------------
PHP (5.2.5) allows you to define '::' as a constant without issuing an
E_WARNING, below examples will demonstrate it.

The constant() function will issue an fatal error when recieving '::'
as constant name:
Fatal error: Class '' not found in C:\webserver\www\gd\gd.php on line
91

Which might also be wrong or confusing to the programmer

Reproduce code:
---------------
<?php
	define('::', true);
	var_dump(constant('::'));
?>

Expected result:
----------------
A fatal error for each of the calls:

Fatal error: Invalid constant name in test.php on line 2

Fatal error: Invalid constant name in test.php on line 3

Actual result:
--------------
Fatal error: Class '' not found in C:\webserver\www\gd\gd.php on line
91

None warning or fatal error for define()...


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=44827&edit=1