handle return type visibility enforcement

Author: withinboredom

Zend/zend_vm_def.h

@@ -1851,10 +1851,7 @@ ZEND_VM_HANDLER(210, ZEND_FETCH_INNER_CLASS, CONST|TMPVAR|UNUSED, CONST, CACHE_S
 			HANDLE_EXCEPTION();
 		}
 	} else {
-		outer_ce = CACHED_PTR(opline->extended_value);
-		if (UNEXPECTED(outer_ce == NULL)) {
-			outer_ce = Z_CE_P(EX_VAR(opline->op1.var));
-		}
+		outer_ce = Z_CE_P(EX_VAR(opline->op1.var));
 	}
 
 	inner_class_name = Z_STR_P(RT_CONSTANT(opline, opline->op2));
@@ -4518,6 +4515,24 @@ ZEND_VM_COLD_CONST_HANDLER(124, ZEND_VERIFY_RETURN_TYPE, CONST|TMP|VAR|UNUSED|CV
 		}
 
 		SAVE_OPLINE();
+
+		if (Z_OBJCE_P(retval_ptr)->required_scope) {
+			if (EX(func)->common.fn_flags & ZEND_ACC_PUBLIC) {
+				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute) {
+					zend_type_error("Method %s is public but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				} else {
+					zend_type_error("Method %s is public but returns a protected class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				}
+			} else if (EX(func)->common.fn_flags & ZEND_ACC_PROTECTED) {
+				if (Z_OBJCE_P(retval_ptr)->required_scope_absolute && Z_OBJCE_P(retval_ptr)->required_scope != EX(func)->common.scope) {
+					zend_type_error("Method %s is protected but returns a private class: %s", ZSTR_VAL(EX(func)->common.function_name), ZSTR_VAL(Z_OBJCE_P(retval_ptr)->name));
+					HANDLE_EXCEPTION();
+				}
+			}
+		}
+
 		if (UNEXPECTED(!zend_check_type_slow(&ret_info->type, retval_ptr, ref, cache_slot, 1, 0))) {
 			zend_verify_return_error(EX(func), retval_ptr);
 			HANDLE_EXCEPTION();
@@ -8264,6 +8279,7 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY)
 
 			case ZEND_FETCH_CLASS:
 			case ZEND_DECLARE_ANON_CLASS:
+			case ZEND_FETCH_INNER_CLASS:
 				break; /* return value is zend_class_entry pointer */
 
 			default:

Zend/zend_vm_execute.h

@@ -6,14 +6,18 @@ private inner class
 class Outer {
     private class Inner {}
 
-    public function getInner(): self:>Inner {
+    private function getInner(): self:>Inner {
         return new self:>Inner();
     }
+
+    public function getInner2(): mixed {
+        return $this->getInner();
+    }
 }
 
 class Foo extends Outer {
     public function getInner(): parent:>Inner {
-        var_dump(parent::getInner());
+        var_dump(parent::getInner2());
         return new parent:>Inner();
     }
 }

tests/classes/inner_classes_014.phpt

@@ -6,7 +6,7 @@ protected inner class
 class Outer {
     protected class Inner {}
 
-    public function getInner(): self:>Inner {
+    protected function getInner(): self:>Inner {
         return new self:>Inner();
     }
 }
@@ -25,7 +25,9 @@ var_dump(new Outer:>Inner());
 --EXPECTF--
 object(Outer:>Inner)#2 (0) {
 }
-object(Outer:>Inner)#2 (0) {
-}
 
-Fatal error: Class 'Outer:>Inner' is protected in %s on line %d
+Fatal error: Uncaught TypeError: Method getInner is public but returns a protected class: Outer:>Inner in %s:%d
+Stack trace:
+#0 %s(%d): Foo->getInner()
+#1 {main}
+  thrown in %s on line %d