From d68311106cef48c3c3c023a4bc27b87a6b08b8e3 Mon Sep 17 00:00:00 2001 From: lazerg Date: Sat, 7 Nov 2026 14:48:48 +0500 Subject: [PATCH 1/2] Fix GH-25266: Misaligned read in ReflectionProperty::isReadable() --- ext/reflection/php_reflection.c | 2 ++ ext/reflection/tests/gh25266.phpt | 13 +++++++++++++ 2 files changed, 15 insertions(+) create mode 100644 ext/reflection/tests/gh25266.phpt diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c index 696828578fca..0b7adbf110b5 100644 --- a/ext/reflection/php_reflection.c +++ b/ext/reflection/php_reflection.c @@ -6748,6 +6748,8 @@ ZEND_METHOD(ReflectionProperty, isReadable) if (!prop->hooks[ZEND_PROPERTY_HOOK_GET]) { RETURN_FALSE; } + } else if (prop->flags & ZEND_ACC_VIRTUAL) { + RETURN_TRUE; } else if (obj && (!prop->hooks || !prop->hooks[ZEND_PROPERTY_HOOK_GET])) { retry_declared:; zval *prop_val = OBJ_PROP(obj, prop->offset); diff --git a/ext/reflection/tests/gh25266.phpt b/ext/reflection/tests/gh25266.phpt new file mode 100644 index 000000000000..f2cf9a0bd14d --- /dev/null +++ b/ext/reflection/tests/gh25266.phpt @@ -0,0 +1,13 @@ +--TEST-- +GH-25266: Misaligned zval read in ReflectionProperty::isReadable() on internal virtual property +--EXTENSIONS-- +dom +--FILE-- +isReadable(null, new DOMDocument)); + +?> +--EXPECT-- +bool(true) From 81140cb1a63fca52f9e71e9afa976c7c1520a5f4 Mon Sep 17 00:00:00 2001 From: lazerg Date: Sat, 7 Nov 2026 17:28:14 +0500 Subject: [PATCH 2/2] Merge virtual property branches in isReadable() --- ext/reflection/php_reflection.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c index 0b7adbf110b5..1b9dfd08a2cf 100644 --- a/ext/reflection/php_reflection.c +++ b/ext/reflection/php_reflection.c @@ -6744,12 +6744,10 @@ ZEND_METHOD(ReflectionProperty, isReadable) RETURN_FALSE; } - if ((prop->flags & ZEND_ACC_VIRTUAL) && prop->hooks) { - if (!prop->hooks[ZEND_PROPERTY_HOOK_GET]) { + if (prop->flags & ZEND_ACC_VIRTUAL) { + if (prop->hooks && !prop->hooks[ZEND_PROPERTY_HOOK_GET]) { RETURN_FALSE; } - } else if (prop->flags & ZEND_ACC_VIRTUAL) { - RETURN_TRUE; } else if (obj && (!prop->hooks || !prop->hooks[ZEND_PROPERTY_HOOK_GET])) { retry_declared:; zval *prop_val = OBJ_PROP(obj, prop->offset);