ensure we do not escape class scope boundaries

Author: withinboredom

Zend/zend_object_handlers.c

@@ -403,7 +403,7 @@ static zend_always_inline uintptr_t zend_get_property_offset(zend_class_entry *c
 					goto dynamic;
 				} else {
 wrong:
-					if (scope && scope->lexical_scope) {
+					if (scope && scope->lexical_scope && scope->lexical_scope->type != ZEND_NAMESPACE_CLASS) {
 						scope = scope->lexical_scope;
 						goto check_lexical_scope;
 					}
@@ -1839,7 +1839,7 @@ ZEND_API zend_function *zend_std_get_method(zend_object **obj_ptr, zend_string *
 				if (zobj->ce->__call) {
 					fbc = zend_get_user_call_function(zobj->ce, method_name);
 				} else {
-					if (scope && scope->lexical_scope) {
+					if (scope && scope->lexical_scope && scope->lexical_scope->type != ZEND_NAMESPACE_CLASS) {
 						scope = scope->lexical_scope;
 						goto check_lexical_scope;
 					}
@@ -1909,7 +1909,7 @@ ZEND_API zend_function *zend_std_get_static_method(zend_class_entry *ce, zend_st
 				 || UNEXPECTED(!zend_check_protected(zend_get_function_root_class(fbc), scope))) {
 					zend_function *fallback_fbc = get_static_method_fallback(ce, function_name);
 					if (!fallback_fbc) {
-						if (scope && scope->lexical_scope) {
+						if (scope && scope->lexical_scope && scope->lexical_scope->type != ZEND_NAMESPACE_CLASS) {
 							scope = scope->lexical_scope;
 							goto check_lexical_scope;
 						}
@@ -1996,7 +1996,7 @@ ZEND_API zval *zend_std_get_static_property_with_info(zend_class_entry *ce, zend
 			if (UNEXPECTED(property_info->flags & ZEND_ACC_PRIVATE)
 			 || UNEXPECTED(!is_protected_compatible_scope(property_info->ce, scope))) {
 				if (type != BP_VAR_IS) {
-					if (scope && scope->lexical_scope) {
+					if (scope && scope->lexical_scope && scope->lexical_scope->type != ZEND_NAMESPACE_CLASS) {
 						scope = scope->lexical_scope;
 						goto check_lexical_scope;
 					}
@@ -2084,7 +2084,7 @@ ZEND_API zend_function *zend_std_get_constructor(zend_object *zobj) /* {{{ */
 			if (UNEXPECTED(constructor->common.scope != scope)) {
 				if (UNEXPECTED(constructor->op_array.fn_flags & ZEND_ACC_PRIVATE)
 				 || UNEXPECTED(!zend_check_protected(zend_get_function_root_class(constructor), scope))) {
-					if (scope && scope->lexical_scope) {
+					if (scope && scope->lexical_scope && scope->lexical_scope->type != ZEND_NAMESPACE_CLASS) {
 						scope = scope->lexical_scope;
 						goto check_lexical_scope;
 					}