: Bug #45622 :: isset($arrayObject->p) misbehaves with ArrayObject::ARRAY_AS_PROPS set
| Bug #45622 | isset($arrayObject->p) misbehaves with ArrayObject::ARRAY_AS_PROPS set | ||||
|---|---|---|---|---|---|
| Submitted: | 2008-07-25 08:59 UTC | Modified: | 2008-07-26 13:24 UTC | ||
| From: | robin_fernandes at uk dot ibm dot com | Assigned: | |||
| Status: | Closed | Package: | SPL related | ||
| PHP Version: | 5.3CVS-2008-07-25 (CVS) | OS: | all | ||
| Private report: | No | CVE-ID: | None | ||
[2008-07-25 08:59 UTC] robin_fernandes at uk dot ibm dot com
Description:
------------
If an instance of ArrayObject $ao has flag ArrayObject::ARRAY_AS_PROPS set, $ao->p will access element p of the underlying storage array - but only if no real property p exists on $ao. If a real property p does exist, it will access that property as if the flag were not set.
This works correctly with read, write and unset, but not with isset:
when a real property p exists, isset($ao->p) always returns false .
Reproduce code:
---------------
<?php
class C extends ArrayObject {
public $p = 'object property';
}
$ao = new C(array('p'=>'array element'));
$ao->setFlags(ArrayObject::ARRAY_AS_PROPS);
echo "\n--> Access the real property:\n";
var_dump(isset($ao->p)); // bug
var_dump($ao->p);
echo "\n--> Remove the real property and access the array element:\n";
unset($ao->p);
var_dump(isset($ao->p));
var_dump($ao->p);
echo "\n--> Remove the array element and try access again:\n";
unset($ao->p);
var_dump(isset($ao->p));
var_dump($ao->p);
?>
Expected result:
----------------
--> Access the real property:
bool(true)
string(15) "object property"
--> Remove the real property and access the array element:
bool(true)
string(13) "array element"
--> Remove the array element and try access again:
bool(false)
Notice: Undefined index: p in %s on line 21
NULL
Actual result:
--------------
--> Access the real property:
bool(false)
string(15) "object property"
--> Remove the real property and access the array element:
bool(true)
string(13) "array element"
--> Remove the array element and try access again:
bool(false)
Notice: Undefined index: p in %s on line 21
NULL
Patches
Pull Requests
History
AllCommentsChangesGit/SVN commits
[2008-07-25 09:01 UTC] robin_fernandes at uk dot ibm dot com
The bug is due to an erroneous return 0 in spl_array_has_property: if ((intern->ar_flags & SPL_ARRAY_ARRAY_AS_PROPS) != 0) { if (!std_object_handlers.has_property(object, member, 2 TSRMLS_CC)) { return spl_array_has_dimension(object, member, has_set_exists TSRMLS_CC); } return 0; /* if prop doesn't exist at all mode 0/1 cannot return 1 */ } The comment states we return 0 when "prop doesn't exist at all", but the previous condition is such that this branch will be taken specifically if the property DOES exist. Here's a simple patch against 5_3: http://pastebin.ca/1082412[2008-07-26 13:24 UTC] lbarnaud@php.net