Hello,
in 5.1.3RC3 there is still memory corruption happening when using __get and
foreach. IMHO this is a critical problem, since this leads to any kind of
program misbehaving up to sigsegv (what happened here in production systems).
As all memory corruption problems this can lead to security related issues as
well.
See http://bugs.php.net/?id=36647
Attached you can find another small script which illustrates how a class
private member variable can be modified from outside the class.
mike
Ilia Alshanetsky wrote:
After a slew of unforeseen delays RC3 of 5.1.3 is finally out and is
ready for testing. If the release proves to be as stable as we all
hope it will be made into final a week from now. Given that this is
the last chance to identify critical problems, testing is essential,
so please give this release a try. The sources can be found here:
http://downloads.php.net/ilia/php-5.1.3RC3.tar.bz2
MD5: f6556ba188c563994c20782918690f3a
Windows snapshots should be available shortly as well.
Ilia Alshanetsky
5.1 Release Master
--
mike peter bretz metropolis ag / entwicklung
email: [EMAIL PROTECTED] heinestraße 72
phone: +49-7121-348-120 d-72762 reutlingen
fax: +49-7121-348-111 http://www.metropolis-ag.de/
metropolis ag. creating social internetworks.
<?
class Foo {
private $data = array("errors" => array(1, 2, 3));
function __get($x) {
return $this->data[$x];
}
}
$t = new Foo();
var_dump($t);
function X(Foo $t) {
$y = $t->errors;
foreach($t->errors as $x);
}
X($t);
$foo = "Some Content";
var_dump($t);
?>
--
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit: http://www.php.net/unsub.php
