cvs: ZendEngine2(PHP_5_2) / zend_object_handlers.c /tests bug46308.phpt php-src NEWS

dmitry		Fri Oct 17 10:25:56 2008 UTC

  Added files:                 (Branch: PHP_5_2)
    /ZendEngine2/tests	bug46308.phpt 

  Modified files:              
    /php-src	NEWS 
    /ZendEngine2	zend_object_handlers.c 
  Log:
  Fixed bug #46308 (Invalid write when changing property from inside getter)
  
  
http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1262&r2=1.2027.2.547.2.1263&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.547.2.1262 php-src/NEWS:1.2027.2.547.2.1263
--- php-src/NEWS:1.2027.2.547.2.1262	Fri Oct 17 01:32:59 2008
+++ php-src/NEWS	Fri Oct 17 10:25:56 2008
@@ -3,6 +3,8 @@
 ?? Oct 2008, PHP 5.2.7RC2
 - Fixed bug #46319 (PHP sets default Content-Type header for HTTP 304
   response code, in cgi sapi). (Ilia)
+- Fixed bug #46308 (Invalid write when changing property from inside getter).
+  (Dmitry)
 - Fixed bug #46292 (PDO::setFetchMode() shouldn't requires the 2nd arg when 
   using FETCH_CLASSTYPE). (Felipe)
 - Fixed bug #46274, #46249 (pdo_pgsql always fill in NULL for empty BLOB and 
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_object_handlers.c?r1=1.135.2.6.2.28&r2=1.135.2.6.2.29&diff_format=u
Index: ZendEngine2/zend_object_handlers.c
diff -u ZendEngine2/zend_object_handlers.c:1.135.2.6.2.28 ZendEngine2/zend_object_handlers.c:1.135.2.6.2.29
--- ZendEngine2/zend_object_handlers.c:1.135.2.6.2.28	Thu Feb 21 13:55:22 2008
+++ ZendEngine2/zend_object_handlers.c	Fri Oct 17 10:25:56 2008
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_object_handlers.c,v 1.135.2.6.2.28 2008/02/21 13:55:22 dmitry Exp $ */
+/* $Id: zend_object_handlers.c,v 1.135.2.6.2.29 2008/10/17 10:25:56 dmitry Exp $ */
 
 #include "zend.h"
 #include "zend_globals.h"
@@ -328,6 +328,7 @@
 		    zend_get_property_guard(zobj, property_info, member, &guard) == SUCCESS &&
 		    !guard->in_get) {
 			/* have getter - try with it! */
+			ZVAL_ADDREF(object);
 			guard->in_get = 1; /* prevent circular getting */
 			rv = zend_std_call_getter(object, member TSRMLS_CC);
 			guard->in_get = 0;
@@ -352,6 +353,7 @@
 			} else {
 				retval = &EG(uninitialized_zval_ptr);
 			}
+			zval_ptr_dtor(&object);
 		} else {
 			if (!silent) {
 				zend_error(E_NOTICE,"Undefined property: %s::$%s", zobj->ce->name, Z_STRVAL_P(member));
@@ -422,12 +424,14 @@
 		if (zobj->ce->__set &&
 		    zend_get_property_guard(zobj, property_info, member, &guard) == SUCCESS &&
 		    !guard->in_set) {
+			ZVAL_ADDREF(object);
 			guard->in_set = 1; /* prevent circular setting */
 			if (zend_std_call_setter(object, member, value TSRMLS_CC) != SUCCESS) {
 				/* for now, just ignore it - __set should take care of warnings, etc. */
 			}
 			setter_done = 1;
 			guard->in_set = 0;
+			zval_ptr_dtor(&object);
 		}
 		if (!setter_done && property_info) {
 			zval **foo;
@@ -602,9 +606,11 @@
 		    zend_get_property_guard(zobj, property_info, member, &guard) == SUCCESS &&
 		    !guard->in_unset) {
 			/* have unseter - try with it! */
+			ZVAL_ADDREF(object);
 			guard->in_unset = 1; /* prevent circular unsetting */
 			zend_std_call_unsetter(object, member TSRMLS_CC);
 			guard->in_unset = 0;
+			zval_ptr_dtor(&object);
 		}
 	}
 
@@ -1020,6 +1026,7 @@
 			zval *rv;
 
 			/* have issetter - try with it! */
+			ZVAL_ADDREF(object);
 			guard->in_isset = 1; /* prevent circular getting */
 			rv = zend_std_call_issetter(object, member TSRMLS_CC);
 			if (rv) {
@@ -1037,6 +1044,7 @@
 				}
 			}
 			guard->in_isset = 0;
+			zval_ptr_dtor(&object);
 		}
 	} else {
 		switch (has_set_exists) {

http://cvs.php.net/viewvc.cgi/ZendEngine2/tests/bug46308.phpt?view=markup&rev=1.1
Index: ZendEngine2/tests/bug46308.phpt
+++ ZendEngine2/tests/bug46308.phpt