$a->foo .= 'test'; can leave $a->foo undefined
| Bug #68118 | $a->foo .= 'test'; can leave $a->foo undefined | ||||
|---|---|---|---|---|---|
| Submitted: | 2014-09-29 15:30 UTC | Modified: | 2014-10-03 20:05 UTC | ||
| From: | rasmus@php.net | Assigned: | nikic (profile) | ||
| Status: | Closed | Package: | Class/Object related | ||
| PHP Version: | 5.5.17 | OS: | Any | ||
| Private report: | No | CVE-ID: | None | ||
[2014-09-29 15:30 UTC] rasmus@php.net
Description: ------------ PHP 5.5 introduced a new undefined property notice for this case: $a->undefined .= 'test'; This means that if a custom error handler is in place it will be triggered, of course. There is a weird side-effect that can happen if the error handler hits the same error causing the property name to be overwritten. eg. http://3v4l.org/KGXhF Compare to: http://3v4l.org/VPmLK PHP 5.6 and PHP 7 are affected as well. Test script: --------------- <?php class test { public function __construct() { $this->test = 'meow'; } } function error_handler() { $test = new test(); return true; } set_error_handler("error_handler"); // test one class a {} $a = new a; $a->undefined .= 'test'; echo isset($a->undefined) ? 'true' : 'false'; echo "\n"; // test two $b .= 'test'; echo isset($b) ? 'true' : 'false'; echo "\n"; Expected result: ---------------- true true Actual result: -------------- false true
Patches
Pull Requests
History
AllCommentsChangesGit/SVN commits
[2014-09-30 14:10 UTC] nikic@php.net
-Status: Open +Status: Analyzed -Assigned To: +Assigned To: dmitry
[2014-09-30 14:10 UTC] nikic@php.net
[2014-09-30 16:40 UTC] rasmus@php.net
[2014-10-03 20:05 UTC] nikic@php.net
-Status: Analyzed +Status: Closed -Assigned To: dmitry +Assigned To: nikic