handle protected/private lookups in outer classes

Author: withinboredom

Zend/zend_object_handlers.c

@@ -381,6 +381,7 @@ static zend_always_inline uintptr_t zend_get_property_offset(zend_class_entry *c
 	if (flags & (ZEND_ACC_CHANGED|ZEND_ACC_PRIVATE|ZEND_ACC_PROTECTED)) {
 		zend_class_entry *scope = get_fake_or_executed_scope();
 
+check_lexical_scope:
 		if (property_info->ce != scope) {
 			if (flags & ZEND_ACC_CHANGED) {
 				zend_property_info *p = zend_get_parent_private_property(scope, ce, member);
@@ -402,6 +403,10 @@ static zend_always_inline uintptr_t zend_get_property_offset(zend_class_entry *c
 					goto dynamic;
 				} else {
 wrong:
+					if (scope && scope->lexical_scope && scope->lexical_scope->type != ZEND_NAMESPACE_CLASS) {
+						scope = scope->lexical_scope;
+						goto check_lexical_scope;
+					}
 					/* Information was available, but we were denied access.  Error out. */
 					if (!silent) {
 						zend_bad_property_access(property_info, ce, member);
@@ -1861,6 +1866,8 @@ ZEND_API zend_function *zend_std_get_method(zend_object **obj_ptr, zend_string *
 	/* Check access level */
 	if (fbc->op_array.fn_flags & (ZEND_ACC_CHANGED|ZEND_ACC_PRIVATE|ZEND_ACC_PROTECTED)) {
 		scope = zend_get_executed_scope();
+		zend_class_entry *original_scope = scope;
+check_lexical_scope:
 
 		if (fbc->common.scope != scope) {
 			if (fbc->op_array.fn_flags & ZEND_ACC_CHANGED) {
@@ -1878,7 +1885,11 @@ ZEND_API zend_function *zend_std_get_method(zend_object **obj_ptr, zend_string *
 				if (zobj->ce->__call) {
 					fbc = zend_get_user_call_function(zobj->ce, method_name);
 				} else {
-					zend_bad_method_call(fbc, method_name, scope);
+					if (scope && scope->lexical_scope && scope->lexical_scope->type != ZEND_NAMESPACE_CLASS) {
+						scope = scope->lexical_scope;
+						goto check_lexical_scope;
+					}
+					zend_bad_method_call(fbc, method_name, original_scope);
 					fbc = NULL;
 				}
 			}
@@ -1937,12 +1948,20 @@ ZEND_API zend_function *zend_std_get_static_method(zend_class_entry *ce, zend_st
 		fbc = Z_FUNC_P(func);
 		if (!(fbc->op_array.fn_flags & ZEND_ACC_PUBLIC)) {
 			zend_class_entry *scope = zend_get_executed_scope();
+			zend_class_entry *original_scope = scope;
+
+check_lexical_scope:
 			if (UNEXPECTED(fbc->common.scope != scope)) {
 				if (UNEXPECTED(fbc->op_array.fn_flags & ZEND_ACC_PRIVATE)
 				 || UNEXPECTED(!zend_check_protected(zend_get_function_root_class(fbc), scope))) {
 					zend_function *fallback_fbc = get_static_method_fallback(ce, function_name);
 					if (!fallback_fbc) {
-						zend_bad_method_call(fbc, function_name, scope);
+						if (scope && scope->lexical_scope && scope->lexical_scope->type != ZEND_NAMESPACE_CLASS) {
+							scope = scope->lexical_scope;
+							goto check_lexical_scope;
+						}
+
+						zend_bad_method_call(fbc, function_name, original_scope);
 					}
 					fbc = fallback_fbc;
 				}
@@ -2019,10 +2038,15 @@ ZEND_API zval *zend_std_get_static_property_with_info(zend_class_entry *ce, zend
 
 	if (!(property_info->flags & ZEND_ACC_PUBLIC)) {
 		zend_class_entry *scope = get_fake_or_executed_scope();
+check_lexical_scope:
 		if (property_info->ce != scope) {
 			if (UNEXPECTED(property_info->flags & ZEND_ACC_PRIVATE)
 			 || UNEXPECTED(!is_protected_compatible_scope(property_info->ce, scope))) {
 				if (type != BP_VAR_IS) {
+					if (scope && scope->lexical_scope && scope->lexical_scope->type != ZEND_NAMESPACE_CLASS) {
+						scope = scope->lexical_scope;
+						goto check_lexical_scope;
+					}
 					zend_bad_property_access(property_info, ce, property_name);
 				}
 				return NULL;
@@ -2103,10 +2127,16 @@ ZEND_API zend_function *zend_std_get_constructor(zend_object *zobj) /* {{{ */
 	if (constructor) {
 		if (UNEXPECTED(!(constructor->op_array.fn_flags & ZEND_ACC_PUBLIC))) {
 			zend_class_entry *scope = get_fake_or_executed_scope();
+			zend_class_entry *original_scope = scope;
+check_lexical_scope:
 			if (UNEXPECTED(constructor->common.scope != scope)) {
 				if (UNEXPECTED(constructor->op_array.fn_flags & ZEND_ACC_PRIVATE)
 				 || UNEXPECTED(!zend_check_protected(zend_get_function_root_class(constructor), scope))) {
-					zend_bad_constructor_call(constructor, scope);
+					if (scope && scope->lexical_scope && scope->lexical_scope->type != ZEND_NAMESPACE_CLASS) {
+						scope = scope->lexical_scope;
+						goto check_lexical_scope;
+					}
+					zend_bad_constructor_call(constructor, original_scope);
 					zend_object_store_ctor_failed(zobj);
 					constructor = NULL;
 				}