Skip to content

Commit 471ae15

Browse files
authored
Fix incorrect zend_hash_find_ptr() on non-ptr in ReflectionProperty::isReadable() (GH-21339)
Fixes OSS-Fuzz #489355368
1 parent 5307a67 commit 471ae15

File tree

2 files changed

+19
-2
lines changed

2 files changed

+19
-2
lines changed

ext/reflection/php_reflection.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6676,7 +6676,7 @@ ZEND_METHOD(ReflectionProperty, isReadable)
66766676

66776677
zend_class_entry *ce = obj ? obj->ce : intern->ce;
66786678
if (!prop) {
6679-
if (obj && obj->properties && zend_hash_find_ptr(obj->properties, ref->unmangled_name)) {
6679+
if (obj && obj->properties && zend_hash_find(obj->properties, ref->unmangled_name)) {
66806680
RETURN_TRUE;
66816681
}
66826682
handle_magic_get:
@@ -6701,7 +6701,7 @@ ZEND_METHOD(ReflectionProperty, isReadable)
67016701
if (!obj) {
67026702
RETURN_THROWS();
67036703
}
6704-
if (obj->properties && zend_hash_find_ptr(obj->properties, ref->unmangled_name)) {
6704+
if (obj->properties && zend_hash_find(obj->properties, ref->unmangled_name)) {
67056705
RETURN_TRUE;
67066706
}
67076707
}
Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
--TEST--
2+
OSS-Fuzz #489355368: Incorrect assumption Z_PTR_P assumption
3+
--FILE--
4+
<?php
5+
6+
#[AllowDynamicProperties]
7+
class A {}
8+
9+
$obj = new A;
10+
$obj->prop = 0;
11+
12+
$rp = new ReflectionProperty($obj, 'prop');
13+
var_dump($rp->isReadable(null, $obj));
14+
15+
?>
16+
--EXPECT--
17+
bool(true)

0 commit comments

Comments
 (0)