Fixed bug #79862

While normally a private property in the active scope would take
priority, we should not use this if it has the wrong "staticness".

Author: nikic

NEWS

@@ -25,6 +25,8 @@ PHP                                                                        NEWS
     array write fetch). (Nikita)
   . Fixed bug #79793 (Use after free if string used in undefined index warning
     is changed). (Nikita)
+  . Fixed bug #79862 (Public non-static property in child should take priority
+    over private static). (Nikita)
 
 - Fileinfo:
   . Fixed bug #79756 (finfo_file crash (FILEINFO_MIME)). (cmb)

Zend/tests/bug79862.phpt

@@ -0,0 +1,60 @@
+--TEST--
+Bug #79862: Public non-static property in child should take priority over private static
+--FILE--
+<?php
+
+class a {
+    private static $prop1;
+    private static $prop2;
+    private $prop3;
+    private $prop4;
+    private static $prop5;
+    private static $prop6;
+    public function __construct() {
+        $this->prop1 = 1;
+        $this->prop2 = 2;
+        $this->prop3 = 3;
+        $this->prop4 = 4;
+        $this->prop5 = 5;
+        $this->prop6 = 6;
+        var_dump(self::$prop1);
+        var_dump(self::$prop2);
+        var_dump(self::$prop5);
+        var_dump(self::$prop6);
+        var_dump($this);
+    }
+}
+class c extends a {
+    public $prop1;
+    protected $prop2;
+    public static $prop3;
+    protected static $prop4;
+    public static $prop5;
+    protected static $prop6;
+}
+
+$c = new c;
+
+?>
+--EXPECTF--
+Notice: Accessing static property c::$prop5 as non static in %s on line %d
+
+Notice: Accessing static property c::$prop6 as non static in %s on line %d
+NULL
+NULL
+NULL
+NULL
+object(c)#1 (6) {
+  ["prop1"]=>
+  int(1)
+  ["prop2":protected]=>
+  int(2)
+  ["prop3":"a":private]=>
+  int(3)
+  ["prop4":"a":private]=>
+  int(4)
+  ["prop5"]=>
+  int(5)
+  ["prop6"]=>
+  int(6)
+}

Zend/zend_object_handlers.c

@@ -421,7 +421,11 @@ static zend_always_inline uintptr_t zend_get_property_offset(zend_class_entry *c
 			if (flags & ZEND_ACC_CHANGED) {
 				zend_property_info *p = zend_get_parent_private_property(scope, ce, member);
 
-				if (p) {
+				/* If there is a public/protected instance property on ce, don't try to use a
+				 * private static property on scope. If both are static, prefer the static
+				 * property on scope. This will throw a static property notice, rather than
+				 * a visibility error. */
+				if (p && (!(p->flags & ZEND_ACC_STATIC) || (flags & ZEND_ACC_STATIC))) {
 					property_info = p;
 					flags = property_info->flags;
 					goto found;