Skip to content

Commit 2bbf2a9

Browse files
committed
Fix assumption about property guard hash value
The "member" string here does not necessarily have a pre-calculated hash value. In particular this is not the case if the class has no properties. Fixes oss-fuzz #25546.
1 parent e97aed4 commit 2bbf2a9

File tree

2 files changed

+18
-2
lines changed

2 files changed

+18
-2
lines changed
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
Test property guard hash value assumption
3+
--FILE--
4+
<?php
5+
class Test {
6+
function __get($var) {
7+
return $this->{$var.''};
8+
}
9+
}
10+
11+
$test = new Test;
12+
var_dump($test->x);
13+
?>
14+
--EXPECTF--
15+
Notice: Undefined property: Test::$x in %s on line %d
16+
NULL

Zend/zend_object_handlers.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -619,8 +619,8 @@ ZEND_API uint32_t *zend_get_property_guard(zend_object *zobj, zend_string *membe
619619
if (EXPECTED(Z_TYPE_P(zv) == IS_STRING)) {
620620
zend_string *str = Z_STR_P(zv);
621621
if (EXPECTED(str == member) ||
622-
/* hash values are always pred-calculated here */
623-
(EXPECTED(ZSTR_H(str) == ZSTR_H(member)) &&
622+
/* "str" always has a pre-calculated hash value here */
623+
(EXPECTED(ZSTR_H(str) == zend_string_hash_val(member)) &&
624624
EXPECTED(zend_string_equal_content(str, member)))) {
625625
return &Z_PROPERTY_GUARD_P(zv);
626626
} else if (EXPECTED(Z_PROPERTY_GUARD_P(zv) == 0)) {

0 commit comments

Comments
 (0)