Repository navigation
Fix GH-24250: Set visibility not enforced after write forwarded to __set() - #24251
DirkHoffman wants to merge 1 commit into
Conversation
… __set() Since 94136cf, the ZEND_ASSIGN_OBJ fast path skips the set visibility check when the cache slot is primed, relying on zend_std_write_property() to reset the slot when the check fails. When an unset property is written through __set(), the check is skipped altogether and the slot primed by zend_get_property_offset() stays valid, so the next write at the same call site to an initialized property bypasses protected(set)/private(set). Reset the cache slot in that case as well.
|
Quoted below: written with Claude, an LLM, as CONTRIBUTING.md asks us to mark. The builds and test runs behind it are on my machine; the commands to repeat them are under the fold.
|
|
Reproduced on current master without the patch. Once a call site is routed through __set, a later protected(set) write from global scope goes through silently instead of throwing. The slot reset mirrors the existing error path and stays narrow enough to leave normal writes alone. Test covers the child-class and readonly-clone cases too. LGTM. |
Fixes GH-24250.
Found and verified with the help of AI tools.