From 07aa7bcc7e3403b18ad3e92bc3d22827aaf8cf57 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Mon, 16 Mar 2026 20:20:52 -0400 Subject: [PATCH] Fix GH-20875: Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies zend_std_get_property_ptr_ptr() was the only property handler that did not propagate the IN_GET guard to the underlying object when forwarding from a lazy proxy after initialization. This caused __get to be called on the underlying object when it shouldn't be, leading to assertion failures. The same guard-copying pattern already existed in read_property, write_property, unset_property, and has_property since commit 26f5009e91 (GH-18039). Also fixes GH-20873 and GH-20854. Closes GH-20875 --- Zend/tests/lazy_objects/gh20854.phpt | 24 ++++++++++++ Zend/tests/lazy_objects/gh20873.phpt | 32 ++++++++++++++++ Zend/tests/lazy_objects/gh20875.phpt | 55 ++++++++++++++++++++++++++++ Zend/zend_object_handlers.c | 35 +++++++++++++++--- 4 files changed, 140 insertions(+), 6 deletions(-) create mode 100644 Zend/tests/lazy_objects/gh20854.phpt create mode 100644 Zend/tests/lazy_objects/gh20873.phpt create mode 100644 Zend/tests/lazy_objects/gh20875.phpt diff --git a/Zend/tests/lazy_objects/gh20854.phpt b/Zend/tests/lazy_objects/gh20854.phpt new file mode 100644 index 0000000000000..57880d89ad7e8 --- /dev/null +++ b/Zend/tests/lazy_objects/gh20854.phpt @@ -0,0 +1,24 @@ +--TEST-- +GH-20854 (Assertion in ZEND_RETURN_BY_REF with lazy proxy and return-by-ref __get) +--FILE-- +x; + } +} + +$rc = new ReflectionClass(C::class); +$obj = $rc->newLazyProxy(function () { + return new C; +}); +$obj->x; +echo "Done\n"; +?> +--EXPECTF-- +Deprecated: Creation of dynamic property C::$x is deprecated in %s on line %d + +Deprecated: Creation of dynamic property C::$x is deprecated in %s on line %d +Done diff --git a/Zend/tests/lazy_objects/gh20873.phpt b/Zend/tests/lazy_objects/gh20873.phpt new file mode 100644 index 0000000000000..e831c568cc153 --- /dev/null +++ b/Zend/tests/lazy_objects/gh20873.phpt @@ -0,0 +1,32 @@ +--TEST-- +GH-20873 (Assertion failure in _zendi_try_convert_scalar_to_number with lazy proxy) +--FILE-- +x =& $this->_; + static $a = $a; + $e =& $this->_ - $a; + } +} +$rc = new ReflectionClass(A::class); +$obj = $rc->newLazyProxy(fn() => new A); +$rc->initializeLazyObject($obj); +var_dump($obj->p); +?> +--EXPECTF-- +Deprecated: Creation of dynamic property A::$x is deprecated in %s on line %d + +Deprecated: Creation of dynamic property A::$x is deprecated in %s on line %d + +Warning: Undefined variable $a in %s on line %d + +Notice: Indirect modification of overloaded property A::$x has no effect in %s on line %d + +Fatal error: Uncaught Error: Cannot assign by reference to overloaded object in %s:%d +Stack trace: +#0 %s(%d): A->__get('p') +#1 {main} + thrown in %s on line %d diff --git a/Zend/tests/lazy_objects/gh20875.phpt b/Zend/tests/lazy_objects/gh20875.phpt new file mode 100644 index 0000000000000..b453e3bde9034 --- /dev/null +++ b/Zend/tests/lazy_objects/gh20875.phpt @@ -0,0 +1,55 @@ +--TEST-- +GH-20875 (Assertion failure in _get_zval_ptr_tmp with lazy proxy) +--FILE-- +f =& $this->b - $x > $y = new StdClass; + static $a = $a; + $t = 'x'; + foreach (get_defined_vars() as $key => $e) {} + if ($v ==!1) $x = $a ?: $t = "ok"; + } +} +$rc = new ReflectionClass(A::class); +$obj = $rc->newLazyProxy(function () { return new A; }); +$real = $rc->initializeLazyObject($obj); +var_dump($real->prop); +?> +--EXPECTF-- +Deprecated: Creation of dynamic property A::$b is deprecated in %s on line %d + +Deprecated: Creation of dynamic property A::$b is deprecated in %s on line %d + +Deprecated: Creation of dynamic property A::$f is deprecated in %s on line %d + +Deprecated: Creation of dynamic property A::$f is deprecated in %s on line %d + +Warning: Undefined variable $x in %s on line %d + +Notice: Object of class stdClass could not be converted to int in %s on line %d + +Warning: Undefined variable $a in %s on line %d + +Warning: Undefined variable $v in %s on line %d + +Notice: Indirect modification of overloaded property A::$b has no effect in %s on line %d + +Deprecated: Creation of dynamic property A::$f is deprecated in %s on line %d + +Warning: Undefined variable $x in %s on line %d + +Notice: Object of class stdClass could not be converted to int in %s on line %d + +Warning: Undefined variable $v in %s on line %d + +Notice: Indirect modification of overloaded property A::$f has no effect in %s on line %d + +Fatal error: Uncaught Error: Cannot assign by reference to overloaded object in %s:%d +Stack trace: +#0 %s(%d): A->__get('b') +#1 %s(%d): A->__get('prop') +#2 {main} + thrown in %s on line %d diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c index 45eac02949d15..10c6c8556b481 100644 --- a/Zend/zend_object_handlers.c +++ b/Zend/zend_object_handlers.c @@ -1409,12 +1409,24 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *nam UNEXPECTED((*zend_get_property_guard(zobj, name)) & IN_GET) || UNEXPECTED(prop_info && (Z_PROP_FLAG_P(retval) & IS_PROP_UNINIT))) { if (UNEXPECTED(zend_lazy_object_must_init(zobj) && (Z_PROP_FLAG_P(retval) & IS_PROP_LAZY))) { - zobj = zend_lazy_object_init(zobj); - if (!zobj) { + bool guarded = zobj->ce->__get + && (*zend_get_property_guard(zobj, name) & IN_GET); + zend_object *instance = zend_lazy_object_init(zobj); + if (!instance) { return &EG(error_zval); } - return zend_std_get_property_ptr_ptr(zobj, name, type, cache_slot); + if (guarded && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS)) { + uint32_t *guard = zend_get_property_guard(instance, name); + if (!(*guard & IN_GET)) { + (*guard) |= IN_GET; + retval = zend_std_get_property_ptr_ptr(instance, name, type, cache_slot); + (*guard) &= ~IN_GET; + return retval; + } + } + + return zend_std_get_property_ptr_ptr(instance, name, type, cache_slot); } if (UNEXPECTED(type == BP_VAR_RW)) { if (prop_info) { @@ -1467,12 +1479,23 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *nam } } if (UNEXPECTED(zend_lazy_object_must_init(zobj))) { - zobj = zend_lazy_object_init(zobj); - if (!zobj) { + bool guarded = (zobj->ce->__get != NULL); + zend_object *instance = zend_lazy_object_init(zobj); + if (!instance) { return &EG(error_zval); } - return zend_std_get_property_ptr_ptr(zobj, name, type, cache_slot); + if (guarded && (instance->ce->ce_flags & ZEND_ACC_USE_GUARDS)) { + uint32_t *guard = zend_get_property_guard(instance, name); + if (!(*guard & IN_GET)) { + (*guard) |= IN_GET; + retval = zend_std_get_property_ptr_ptr(instance, name, type, cache_slot); + (*guard) &= ~IN_GET; + return retval; + } + } + + return zend_std_get_property_ptr_ptr(instance, name, type, cache_slot); } if (UNEXPECTED(!zobj->properties)) { rebuild_object_properties_internal(zobj);