changes to $name in __get($name) override future parameters

Bug #31683

Submitted:

2005-01-25 01:50 UTC

Modified:

2005-02-02 19:17 UTC

Votes:	2
Avg. Score:	3.0 ± 1.0
Reproduced:	2 of 2 (100.0%)
Same Version:	1 (50.0%)
Same OS:	0 (0.0%)

From:

wagner at bonn dot edu

Assigned:

dmitry (profile)

Status:

Closed

Package:

Scripting Engine problem

PHP Version:

5CVS-2005-02-02 (dev)

OS:

Gentoo Linux

Private report:

CVE-ID:

None

[2005-01-25 01:50 UTC] wagner at bonn dot edu

Description:
------------
Changing $name in __get($name) to e.g. "foo", will cause   
the next call of __get() to use "foo" as the name instead   
of the name of the member-Variable that was actually 
called. 
Only intercepted accesses to variables (e.g. 
$obj->doesnt_exist) seem to be affected, not direct calls 
to __get() (e.g. $obj->__get("whatever") ); 
  
Reproducible with PHP 5.0.3, PHP_5_0 CVS and CVS head (PHP  
5.1 dev).  

Reproduce code:
---------------
<?php 
class testclass { 
  public function __get($name) { 
    echo "$name \n"; 
    $name = "wrong";
  } 
} 

$obj = new testclass(); 

for ($i=1; $i <=3; $i++) { 
  $dummy = $obj->correct; 
}
?> 


Expected result:
----------------
correct   
correct  
correct  
 
The line 
$name = "wrong"; 
should have no effect. 

Actual result:
--------------
correct  
wrong  
wrong

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2005-01-31 11:14 UTC] sebastian at famro dot de

This bug concerns also the Function __set(): 
 
Reproduce code: 
--------------- 
<?php 
class testclass {  
  public function __set($name, $value) {  
    echo "$name = $value\n";  
    $name = "wrong"; 
    $value = 1; 
  }  
}  
 
$obj = new testclass();  
 
for ($i=1; $i <=3; $i++) {  
  $obj->correct = 0;  
} 
?> 
 
Actual result: 
-------------- 
correct = 0 
wrong = 0 
wrong = 0

[2005-02-02 19:17 UTC] wagner at bonn dot edu

Fixes work for me, both __get() and __set() in  
PHP_5_0 and HEAD.