- MFH: Fix bug #37212 (Access to protected property of common base cl…

…ass)

  By adding "zend_class_entry *ce" to struct zend_property_info;

Zend/tests/bug37212.phpt

@@ -0,0 +1,55 @@
+--TEST--
+Bug #3721 (Access to protected property of common base class)
+--FILE--
+<?php
+
+class A
+{
+    protected $value;
+
+    public function __construct($val)
+    {
+        $this->value = $val;
+    }
+
+    protected function getValue()
+    {
+        return $this->value;
+    }
+}
+
+class B extends A
+{
+    public function copyValue($obj)
+    {
+        $this->value = $obj->getValue();
+        $this->value = $obj->value; // value defined in common base class
+    }
+}
+class C extends A {}
+
+$B = new B("B");
+var_dump($B);
+$C = new C("C");
+var_dump($C);
+
+$B->copyValue($C);
+
+var_dump($B);
+
+?>
+===DONE===
+--EXPECTF--
+object(B)#%d (1) {
+  ["value:protected"]=>
+  string(1) "B"
+}
+object(C)#%d (1) {
+  ["value:protected"]=>
+  string(1) "C"
+}
+object(B)#%d (1) {
+  ["value:protected"]=>
+  string(1) "C"
+}
+===DONE===

Zend/zend_API.c

@@ -2376,6 +2376,8 @@ ZEND_API int zend_declare_property_ex(zend_class_entry *ce, char *name, int name
 
 	property_info.doc_comment = doc_comment;
 	property_info.doc_comment_len = doc_comment_len;
+
+	property_info.ce = ce;
 
 	zend_hash_update(&ce->properties_info, name, name_length + 1, &property_info, sizeof(zend_property_info), NULL);
 

Zend/zend_compile.h

@@ -5,7 +5,7 @@
    | Copyright (c) 1998-2006 Zend Technologies Ltd. (http://www.zend.com) |
    +----------------------------------------------------------------------+
    | This source file is subject to version 2.00 of the Zend license,     |
-   | that is bundled with this package in the file LICENSE, and is        | 
+   | that is bundled with this package in the file LICENSE, and is        |
    | available through the world-wide-web at the following url:           |
    | http://www.zend.com/license/2_00.txt.                                |
    | If you did not receive a copy of the Zend license and are unable to  |
@@ -149,6 +149,7 @@ typedef struct _zend_property_info {
 	ulong h;
 	char *doc_comment;
 	int doc_comment_len;
+	zend_class_entry *ce;
 } zend_property_info;
 
 

Zend/zend_object_handlers.c

@@ -150,7 +150,7 @@ static int zend_verify_property_access(zend_property_info *property_info, zend_c
 		case ZEND_ACC_PUBLIC:
 			return 1;
 		case ZEND_ACC_PROTECTED:
-			return zend_check_protected(ce, EG(scope));
+			return zend_check_protected(property_info->ce, EG(scope));
 		case ZEND_ACC_PRIVATE:
 			if (ce==EG(scope) && EG(scope)) {
 				return 1;
@@ -190,7 +190,7 @@ ZEND_API struct _zend_property_info *zend_get_property_info(zend_class_entry *ce
 				zend_error(E_ERROR, "Cannot access property started with '\\0'");
 			}
 		}
-		return NULL;				
+		return NULL;
 	}
 	h = zend_get_hash_value(Z_STRVAL_P(member), Z_STRLEN_P(member) + 1);
 	if (zend_hash_quick_find(&ce->properties_info, Z_STRVAL_P(member), Z_STRLEN_P(member)+1, h, (void **) &property_info)==SUCCESS) {
@@ -238,6 +238,7 @@ ZEND_API struct _zend_property_info *zend_get_property_info(zend_class_entry *ce
 		EG(std_property_info).name = Z_STRVAL_P(member);
 		EG(std_property_info).name_length = Z_STRLEN_P(member);
 		EG(std_property_info).h = h;
+		EG(std_property_info).ce = ce;
 		property_info = &EG(std_property_info);
 	}
 	return property_info;
@@ -579,7 +580,7 @@ static void zend_std_unset_property(zval *object, zval *member TSRMLS_DC)
 		    zend_get_property_guard(zobj, property_info, member, &guard) == SUCCESS &&
 		    !guard->in_unset) {
 			/* have unseter - try with it! */
-			guard->in_unset = 1; /* prevent circular setting */
+			guard->in_unset = 1; /* prevent circular unsetting */
 			zend_std_call_unsetter(object, member TSRMLS_CC);
 			guard->in_unset = 0;
 		}
@@ -842,6 +843,7 @@ ZEND_API zval **zend_std_get_static_property(zend_class_entry *ce, char *propert
 		std_property_info.name = property_name;
 		std_property_info.name_length = property_name_len;
 		std_property_info.h = zend_get_hash_value(std_property_info.name, std_property_info.name_length+1);
+		std_property_info.ce = ce;
 		property_info = &std_property_info;
 	}