com php-src: BUG #73998: Numeric properties are not accessible from get_object_vars: NEWS Zend/tests/bug73998 .phpt Zend/zend_builtin_functions.c Zend/zend_has h.h

Commit:    dd9cf23457e21d2bda29dc92d437b9dbd14027b2
Author:    Mitch Hagstrand <[email protected]>         Tue, 31 Jan 2017 09:25:05 -0800
Committer: Nikita Popov <[email protected]>      Thu, 2 Feb 2017 18:33:10 +0100
Parents:   acda2563cea2acacdb126a6c14a144a9bf52e3a3
Branches:  PHP-7.0 PHP-7.1 master

Link:       http://git.php.net/?p=php-src.git;a=commitdiff;h=dd9cf23457e21d2bda29dc92d437b9dbd14027b2

Log:
BUG #73998: Numeric properties are not accessible from get_object_vars

Bugs:
https://bugs.php.net/73998

Changed paths:
  M  NEWS
  A  Zend/tests/bug73998.phpt
  M  Zend/zend_builtin_functions.c
  M  Zend/zend_hash.h


Diff:
diff --git a/NEWS b/NEWS
index 249830d..c225dbb 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #73807 (Performance problem with processing large post request).
     (Nikita)
+  . Fixed bug #73998 (array_key_exists fails on arrays created by
+    get_object_vars). (mhagstrand)
 
 - GD:
   . Fixed bug #74031 (ReflectionFunction for imagepng is missing last two
diff --git a/Zend/tests/bug73998.phpt b/Zend/tests/bug73998.phpt
new file mode 100644
index 0000000..4181326
--- /dev/null
+++ b/Zend/tests/bug73998.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #73998 (array_key_exists fails on arrays created by get_object_vars)
+--DESCRIPTION--
+Properties of objects with numeric names should be accessible
+--FILE--
+<?php
+$a = new stdClass;
+$a->{1234} = "Numeric";
+$a->a1234 = "String";
+
+$properties = get_object_vars($a);
+var_dump(array_key_exists(1234, $properties));
+echo "Value: {$properties[1234]}\n";
+
+?>
+--EXPECT--
+bool(true)
+Value: Numeric
+
diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index aa705d3..3b04ead 100644
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -1146,6 +1146,8 @@ ZEND_FUNCTION(get_object_vars)
 	HashTable *properties;
 	zend_string *key;
 	zend_object *zobj;
+	zend_ulong index;
+	zend_bool fast_copy = 0;
 
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_OBJECT(obj)
@@ -1164,7 +1166,17 @@ ZEND_FUNCTION(get_object_vars)
 	zobj = Z_OBJ_P(obj);
 
 	if (!zobj->ce->default_properties_count && properties == zobj->properties && !ZEND_HASH_GET_APPLY_COUNT(properties)) {
-		/* fast copy */
+		fast_copy = 1;
+		/* Check if the object has a numeric property, See Bug 73998 */
+		ZEND_HASH_FOREACH_STR_KEY(properties, key) {
+			if (key && ZEND_HANDLE_NUMERIC(key, index)) {
+				fast_copy = 0;
+				break;
+			}
+		} ZEND_HASH_FOREACH_END();
+	}
+
+	if (fast_copy) {
 		if (EXPECTED(zobj->handlers == &std_object_handlers)) {
 			if (EXPECTED(!(GC_FLAGS(properties) & IS_ARRAY_IMMUTABLE))) {
 				GC_REFCOUNT(properties)++;
@@ -1190,7 +1202,7 @@ ZEND_FUNCTION(get_object_vars)
 						zend_unmangle_property_name_ex(key, &class_name, &prop_name, &prop_len);
 						zend_hash_str_add_new(Z_ARRVAL_P(return_value), prop_name, prop_len, value);
 					} else {
-						zend_hash_add_new(Z_ARRVAL_P(return_value), key, value);
+						zend_symbtable_add_new(Z_ARRVAL_P(return_value), key, value);
 					}
 				}
 			}
diff --git a/Zend/zend_hash.h b/Zend/zend_hash.h
index d76645c..f369677 100644
--- a/Zend/zend_hash.h
+++ b/Zend/zend_hash.h
@@ -310,6 +310,16 @@ static zend_always_inline int zend_hash_str_exists_ind(const HashTable *ht, cons
 			Z_TYPE_P(Z_INDIRECT_P(zv)) != IS_UNDEF);
 }
 
+static zend_always_inline zval *zend_symbtable_add_new(HashTable *ht, zend_string *key, zval *pData)
+{
+	zend_ulong idx;
+
+	if (ZEND_HANDLE_NUMERIC(key, idx)) {
+		return zend_hash_index_add_new(ht, idx, pData);
+	} else {
+		return zend_hash_add_new(ht, key, pData);
+	}
+}
 
 static zend_always_inline zval *zend_symtable_update(HashTable *ht, zend_string *key, zval *pData)
 {