Fixed bug #41961 (Ensure search for hidden private methods does not stray from class hierarchy). (robin_fernandes at uk dot ibm dot com)

NEWS

@@ -58,6 +58,8 @@ PHP                                                                        NEWS
 - Fixed PECL bug #11216 (crash in ZipArchive::addEmptyDir when a directory 
   already exists). (Pierre)
 
+- Fixed bug #41961 (Ensure search for hidden private methods does not stray
+  from class hierarchy). (robin_fernandes at uk dot ibm dot com)
 - Fixed bug #41947 (SimpleXML incorrectly registers empty strings as 
   namespaces). (Rob)
 - Fixed bug #41919 (crash in string to array conversion).

Zend/tests/bug41961.phpt

@@ -0,0 +1,29 @@
+--TEST--
+Bug #41961 (Ensure search for hidden private methods does not stray from class hierarchy)
+--FILE--
+<?php
+X::test();
+ 
+/** Class X is related to neither ParentClass nor ChildClass. */
+class X {
+  public static function test() {
+    $myChild = new ChildClass;  
+    $myChild->secret(); // bug - invokes X::secret() instead of ChildClass::secret()
+  }
+  private function secret() {
+    echo "Called private " . __METHOD__ . "() on an instance of: " . get_class($this) . "\n";
+  } 
+}
+ 
+class ParentClass { 
+  private function secret() { }
+}
+ 
+class ChildClass extends ParentClass {
+  public function secret() {
+    echo "Called public " . __METHOD__ . "() on an instance of: " . get_class($this) . "\n";
+  } 
+}
+?>
+--EXPECT--
+Called public ChildClass::secret() on an instance of: ChildClass

Zend/zend_object_handlers.c

@@ -800,7 +800,9 @@ static union _zend_function *zend_std_get_method(zval **object_ptr, char *method
 		/* Ensure that we haven't overridden a private function and end up calling
 		 * the overriding public function...
 		 */
-		if (EG(scope) && fbc->op_array.fn_flags & ZEND_ACC_CHANGED) {
+		if (EG(scope) &&
+		    is_derived_class(fbc->common.scope, EG(scope)) &&
+		    fbc->op_array.fn_flags & ZEND_ACC_CHANGED) {
 			zend_function *priv_fbc;
 
 			if (zend_hash_find(&EG(scope)->function_table, lc_method_name, method_len+1, (void **) &priv_fbc)==SUCCESS