diff options
| -rw-r--r-- | NEWS | 8 | ||||
| -rw-r--r-- | Zend/tests/bug71336.phpt | 48 | ||||
| -rw-r--r-- | Zend/zend_builtin_functions.c | 8 |
3 files changed, 59 insertions, 5 deletions
@@ -2,10 +2,9 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2016 PHP 7.0.3 -- Apache2handler: - . Fix >2G Content-Length headers in apache2handler. (Adam Harvey) - - Core: + . Fixed bug #71336 (Wrong is_ref on properties as exposed via + get_object_vars()). (Laruence) . Fixed bug #71248 (Wrong interface is enforced). (Dmitry) . Fixed bug #71300 (Segfault in zend_fetch_string_offset). (Laruence) . Fixed bug #71221 (Null pointer deref (segfault) in get_defined_vars via @@ -19,6 +18,9 @@ PHP NEWS . Fixed bug #71297 (Memory leak with consecutive yield from). (Bob) . Fixed bug #71314 (var_export(INF) prints INF.0). (Andrea) +- Apache2handler: + . Fix >2G Content-Length headers in apache2handler. (Adam Harvey) + - CURL: . Fixed bug #71227 (Can't compile php_curl statically). (Anatol) . Fixed bug #71225 (curl_setopt() fails to set CURLOPT_POSTFIELDS with diff --git a/Zend/tests/bug71336.phpt b/Zend/tests/bug71336.phpt new file mode 100644 index 0000000000..c5da420da0 --- /dev/null +++ b/Zend/tests/bug71336.phpt @@ -0,0 +1,48 @@ +--TEST-- +Bug #71336 (Wrong is_ref on properties as exposed via get_object_vars()) +--FILE-- +<?php +class A +{ + protected $bar = array('baz'); + + function bar() + { + array_pop($this->bar); + $vars = get_object_vars($this); + $this->bar[] = array('buz'); + print_r($vars); + } + + function foo() { + array_pop($this->bar); + $dummy = &$this->bar; + $vars = get_object_vars($this); + $this->bar[] = array('buz'); + print_r($vars); + } +} + +(new A())->bar(); +(new A())->foo(); +?> +--EXPECT-- +Array +( + [bar] => Array + ( + ) + +) +Array +( + [bar] => Array + ( + [0] => Array + ( + [0] => buz + ) + + ) + +) diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c index ff5fa4fcab..231424f1de 100644 --- a/Zend/zend_builtin_functions.c +++ b/Zend/zend_builtin_functions.c @@ -1198,8 +1198,12 @@ ZEND_FUNCTION(get_object_vars) ZEND_HASH_FOREACH_STR_KEY_VAL_IND(properties, key, value) { if (key) { if (zend_check_property_access(zobj, key) == SUCCESS) { - /* Not separating references */ - if (Z_REFCOUNTED_P(value)) Z_ADDREF_P(value); + if (Z_ISREF_P(value) && Z_REFCOUNT_P(value) == 1) { + value = Z_REFVAL_P(value); + } + if (Z_REFCOUNTED_P(value)) { + Z_ADDREF_P(value); + } if (ZSTR_VAL(key)[0] == 0) { const char *prop_name, *class_name; size_t prop_len; |