diff options
author | Dmitry Stogov <dmitry@zend.com> | 2017-10-26 16:03:42 +0300 |
---|---|---|
committer | Dmitry Stogov <dmitry@zend.com> | 2017-10-26 16:03:42 +0300 |
commit | 98eee90734c4fabf3f3a3d4168576cb6b25ad9b1 (patch) | |
tree | 96586e85d4a3f4184a8c5fd01d31cb1d94d8da08 /Zend/tests | |
parent | 502cfddf28c4a01d7f2d23f35ff6244ae7428103 (diff) | |
download | php-git-98eee90734c4fabf3f3a3d4168576cb6b25ad9b1.tar.gz |
Fixed indirect modification of magic ArrayAccess method arguments
Diffstat (limited to 'Zend/tests')
-rw-r--r-- | Zend/tests/bug75420.10.phpt | 21 | ||||
-rw-r--r-- | Zend/tests/bug75420.11.phpt | 20 | ||||
-rw-r--r-- | Zend/tests/bug75420.12.phpt | 21 | ||||
-rw-r--r-- | Zend/tests/bug75420.13.phpt | 20 | ||||
-rw-r--r-- | Zend/tests/bug75420.14.phpt | 20 | ||||
-rw-r--r-- | Zend/tests/bug75420.15.phpt | 20 | ||||
-rw-r--r-- | Zend/tests/bug75420.16.phpt | 20 | ||||
-rw-r--r-- | Zend/tests/bug75420.9.phpt | 20 |
8 files changed, 162 insertions, 0 deletions
diff --git a/Zend/tests/bug75420.10.phpt b/Zend/tests/bug75420.10.phpt new file mode 100644 index 0000000000..c2ae3aa55d --- /dev/null +++ b/Zend/tests/bug75420.10.phpt @@ -0,0 +1,21 @@ +--TEST-- +Bug #75420.10 (Indirect modification of magic method argument) +--FILE-- +<?php +class Test implements ArrayAccess { + public function offsetExists($x) { $GLOBALS["name"] = 24; return true; } + public function offsetGet($x) { var_dump($x); return 42; } + public function offsetSet($x, $y) { } + public function offsetUnset($x) { } +} + +$obj = new Test; +$name = "foo"; +$name = str_repeat($name, 2); +var_dump($obj[$name] ?? 12); +var_dump($name); +?> +--EXPECT-- +string(6) "foofoo" +int(42) +int(24) diff --git a/Zend/tests/bug75420.11.phpt b/Zend/tests/bug75420.11.phpt new file mode 100644 index 0000000000..1ec623e41c --- /dev/null +++ b/Zend/tests/bug75420.11.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #75420.11 (Indirect modification of magic method argument) +--FILE-- +<?php +class Test implements ArrayAccess { + public function offsetExists($x) { $GLOBALS["name"] = 24; return true; } + public function offsetGet($x) { var_dump($x); return 42; } + public function offsetSet($x, $y) { } + public function offsetUnset($x) { } +} + +$obj = new Test; +$name = "foo"; +var_dump(empty($obj[$name])); +var_dump($name); +?> +--EXPECT-- +string(3) "foo" +bool(false) +int(24) diff --git a/Zend/tests/bug75420.12.phpt b/Zend/tests/bug75420.12.phpt new file mode 100644 index 0000000000..7ed6f1474b --- /dev/null +++ b/Zend/tests/bug75420.12.phpt @@ -0,0 +1,21 @@ +--TEST-- +Bug #75420.12 (Indirect modification of magic method argument) +--FILE-- +<?php +class Test implements ArrayAccess { + public function offsetExists($x) { $GLOBALS["name"] = 24; return true; } + public function offsetGet($x) { var_dump($x); return 42; } + public function offsetSet($x, $y) { } + public function offsetUnset($x) { } +} + +$obj = new Test; +$name = "foo"; +$name = str_repeat($name, 2); +var_dump(empty($obj[$name])); +var_dump($name); +?> +--EXPECT-- +string(6) "foofoo" +bool(false) +int(24) diff --git a/Zend/tests/bug75420.13.phpt b/Zend/tests/bug75420.13.phpt new file mode 100644 index 0000000000..38031badd7 --- /dev/null +++ b/Zend/tests/bug75420.13.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #75420.13 (Indirect modification of magic method argument) +--FILE-- +<?php +class Test implements ArrayAccess { + public function offsetExists($x) { $GLOBALS["obj"] = 24; return true; } + public function offsetGet($x) { var_dump($x); return 42; } + public function offsetSet($x, $y) { } + public function offsetUnset($x) { } +} + +$obj = new Test; +$name = "foo"; +var_dump($obj[$name] ?? 12); +var_dump($obj); +?> +--EXPECT-- +string(3) "foo" +int(42) +int(24) diff --git a/Zend/tests/bug75420.14.phpt b/Zend/tests/bug75420.14.phpt new file mode 100644 index 0000000000..07fb2cd984 --- /dev/null +++ b/Zend/tests/bug75420.14.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #75420.14 (Indirect modification of magic method argument) +--FILE-- +<?php +class Test implements ArrayAccess { + public function offsetExists($x) { $GLOBALS["obj"] = 24; return true; } + public function offsetGet($x) { var_dump($x); return 42; } + public function offsetSet($x, $y) { } + public function offsetUnset($x) { } +} + +$obj = new Test; +$name = "foo"; +var_dump(empty($obj[$name])); +var_dump($obj); +?> +--EXPECT-- +string(3) "foo" +bool(false) +int(24) diff --git a/Zend/tests/bug75420.15.phpt b/Zend/tests/bug75420.15.phpt new file mode 100644 index 0000000000..f747b4c887 --- /dev/null +++ b/Zend/tests/bug75420.15.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #75420.15 (Indirect modification of magic method argument) +--FILE-- +<?php +class Test implements ArrayAccess { + public function offsetExists($x) { } + public function offsetGet($x) { } + public function offsetSet($x, $y) { $GLOBALS["name"] = 24; var_dump($x); } + public function offsetUnset($x) { } +} + +$obj = new Test; +$name = "foo"; +$name = str_repeat($name, 2); +$obj[$name] = 1; +var_dump($name); +?> +--EXPECT-- +string(6) "foofoo" +int(24) diff --git a/Zend/tests/bug75420.16.phpt b/Zend/tests/bug75420.16.phpt new file mode 100644 index 0000000000..6c3982eacc --- /dev/null +++ b/Zend/tests/bug75420.16.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #75420.16 (Indirect modification of magic method argument) +--FILE-- +<?php +class Test implements ArrayAccess { + public function offsetExists($x) { } + public function offsetGet($x) { } + public function offsetSet($x, $y) { $GLOBALS["obj"] = 24; var_dump($this); } + public function offsetUnset($x) { } +} + +$obj = new Test; +$name = "foo"; +$obj[$name] = 1; +var_dump($obj); +?> +--EXPECT-- +object(Test)#1 (0) { +} +int(24) diff --git a/Zend/tests/bug75420.9.phpt b/Zend/tests/bug75420.9.phpt new file mode 100644 index 0000000000..d83878e773 --- /dev/null +++ b/Zend/tests/bug75420.9.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #75420.9 (Indirect modification of magic method argument) +--FILE-- +<?php +class Test implements ArrayAccess { + public function offsetExists($x) { $GLOBALS["name"] = 24; return true; } + public function offsetGet($x) { var_dump($x); return 42; } + public function offsetSet($x, $y) { } + public function offsetUnset($x) { } +} + +$obj = new Test; +$name = "foo"; +var_dump($obj[$name] ?? 12); +var_dump($name); +?> +--EXPECT-- +string(3) "foo" +int(42) +int(24) |