From 2543e61aed67add7522e0b4cdf9a13cf3e441f6f Mon Sep 17 00:00:00 2001 From: Nikita Popov Date: Fri, 22 Jun 2018 12:58:48 +0200 Subject: Fixed bug #76509 In PHP static properties are shared between inheriting classes, unless they are explicitly overwritten. However, because this functionality was implemented using reference, it was possible to break the implementation by reassigning the static property reference. This is fixed by switching the implementation from using references to using INDIRECTs, which cannot be affected by userland code. --- Zend/zend_builtin_functions.c | 1 + 1 file changed, 1 insertion(+) (limited to 'Zend/zend_builtin_functions.c') diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c index e4d3b2df5c..591c8af17f 100644 --- a/Zend/zend_builtin_functions.c +++ b/Zend/zend_builtin_functions.c @@ -1071,6 +1071,7 @@ static void add_class_vars(zend_class_entry *scope, zend_class_entry *ce, int st prop = NULL; if (statics && (prop_info->flags & ZEND_ACC_STATIC) != 0) { prop = &ce->default_static_members_table[prop_info->offset]; + ZVAL_DEINDIRECT(prop); } else if (!statics && (prop_info->flags & ZEND_ACC_STATIC) == 0) { prop = &ce->default_properties_table[OBJ_PROP_TO_NUM(prop_info->offset)]; } -- cgit v1.2.1