Skip to content

Properly handle reference return value from __toString() #18810

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
+47 −0
Closed

Properly handle reference return value from __toString() #18810

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions Zend/tests/exceptions/exception_fatal_uncaught_error_reference_tostring.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
--TEST--
Exception fatal uncaught error with reference __toString
--FILE--
<?php

class MyException extends Exception {
private $field = 'my string';
public function &__toString(): string {
return $this->field;
}
}

// Must not be caught to trigger the issue!
throw new MyException;

?>
--EXPECTF--
Fatal error: Uncaught my string
thrown in %s on line %d
17 changes: 17 additions & 0 deletions Zend/tests/type_casts/string_cast_reference_tostring.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
--TEST--
String cast with reference __toString
--FILE--
<?php

class MyClass {
private $field = 'my string';
public function &__toString(): string {
return $this->field;
}
}

echo new MyClass;

?>
--EXPECT--
my string
3 changes: 3 additions & 0 deletions Zend/zend_exceptions.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -980,6 +980,9 @@ ZEND_API ZEND_COLD zend_result zend_exception_error(zend_object *ex, int severit

zend_call_known_instance_method_with_0_params(ex->ce->__tostring, ex, &tmp);
if (!EG(exception)) {
if (UNEXPECTED(Z_ISREF(tmp))) {
zend_unwrap_reference(&tmp);
}
if (Z_TYPE(tmp) != IS_STRING) {
zend_error(E_WARNING, "%s::__toString() must return a string", ZSTR_VAL(ce_exception->name));
} else {
Expand Down
4 changes: 4 additions & 0 deletions Zend/zend_object_handlers.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2440,8 +2440,12 @@ ZEND_API zend_result zend_std_cast_object_tostring(zend_object *readobj, zval *w
zend_call_known_instance_method_with_0_params(ce->__tostring, readobj, &retval);
zend_object_release(readobj);
if (EXPECTED(Z_TYPE(retval) == IS_STRING)) {
is_string:
ZVAL_COPY_VALUE(writeobj, &retval);
return SUCCESS;
} else if (Z_ISREF(retval)) {
zend_unwrap_reference(&retval);
goto is_string;
}
zval_ptr_dtor(&retval);
if (!EG(exception)) {
Expand Down
4 changes: 4 additions & 0 deletions sapi/phpdbg/phpdbg_prompt.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -702,6 +702,10 @@ static inline void phpdbg_handle_exception(void) /* {{{ */
EG(exception) = NULL;
msg = ZSTR_EMPTY_ALLOC();
} else {
if (UNEXPECTED(Z_ISREF(tmp))) {
zend_unwrap_reference(&tmp);
}
ZEND_ASSERT(Z_TYPE(tmp) == IS_STRING);
zend_update_property_string(zend_get_exception_base(ex), ex, ZEND_STRL("string"), Z_STRVAL(tmp));
zval_ptr_dtor(&tmp);
msg = zval_get_string(zend_read_property_ex(zend_get_exception_base(ex), ex, ZSTR_KNOWN(ZEND_STR_STRING), /* silent */ true, &rv));
Expand Down