Home Original page

extract() problem with array containing word "this"

Bug #47409 extract() problem with array containing word "this"
Submitted: 2009-02-16 18:48 UTC Modified: 2009-12-23 16:34 UTC
From: niximor at gmail dot com Assigned:
Status: Closed Package: Scripting Engine problem
PHP Version: 5.2.9 OS: Windows Vista
Private report: No CVE-ID: None

 [2009-02-16 18:48 UTC] niximor at gmail dot com

Description:
------------
When I use extract() with array, that contains key "this", it behaves really weird. See code for more info.

Reproduce code:
---------------
class Test1 {
	var $name = "test1";
}

class Test2 {
	var $name = "test2";

	function bug() {
		extract(array("this"=>new Test1()), EXTR_OVERWRITE | EXTR_REFS);
		echo get_class($this)."::name = ".$this->name;
	}
}

$t = new Test2();
$t->bug();


Expected result:
----------------
Test1::name = test1 (preferably)
OR
Test2::name = test2
- not combination of both.

Actual result:
--------------
Test1::name = test2

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

 [2009-02-21 20:23 UTC] niximor at gmail dot com

With latest version downloaded just now (5.2.9RC4-dev) same result as with RC2 (Test1::name = test2).

 [2009-10-13 18:57 UTC] chrisstocktonaz at gmail dot com

I think your second proposal on expected behavior would be more 
correct, rewriting $this doesn't seem right :p Below is a simple 
patch:

Index: ext/standard/array.c
===================================================================
--- ext/standard/array.c        (revision 289616)
+++ ext/standard/array.c        (working copy)
@@ -1364,6 +1364,10 @@
                                if (var_exists && var_name_len == 
sizeof("GLOBALS") && !strcmp(var_name, "GLOBALS")) {
                                        break;
                                }
+                                /* THIS protection */
+                               if (var_exists && var_name_len == 
(sizeof("this")-1) && !strcmp(var_name, "this") && EG(scope) && "" != 
EG(scope)->name) {
+                                       break;
+                               }
                                ZVAL_STRINGL(&final_name, var_name, 
var_name_len, 1);
                                break;

 [2009-12-23 16:34 UTC] iliaa@php.net

This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.