From fc04a6ebdd65523b0d66e4c04c2077f9072f831a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1t=C3=A9=20Kocsis?= <kocsismate@woohoolabs.com>
Date: Tue, 3 May 2022 21:21:36 +0200
Subject: [PATCH] Throw when calling ReflectionAttribute::__construct()

ReflectionAttribute::__construct() accepted any number of parameters until now, because parameter validation was missing. Even though this was unlikely to be an issue in practice (since the method is private), the problem is fixed by always throwing an exception.
---
 ext/reflection/php_reflection.c               |  1 +
 .../ReflectionAttribute_constructor_001.phpt  | 25 +++++++++++++++++++
 2 files changed, 26 insertions(+)
 create mode 100644 ext/reflection/tests/ReflectionAttribute_constructor_001.phpt

diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index 0a4c0adcfc0..6fb85154a76 100644
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -6395,6 +6395,7 @@ ZEND_METHOD(ReflectionReference, getId)
 
 ZEND_METHOD(ReflectionAttribute, __construct)
 {
+	_DO_THROW("Cannot directly instantiate ReflectionAttribute");
 }
 
 ZEND_METHOD(ReflectionAttribute, __clone)
diff --git a/ext/reflection/tests/ReflectionAttribute_constructor_001.phpt b/ext/reflection/tests/ReflectionAttribute_constructor_001.phpt
new file mode 100644
index 00000000000..ad895dc4243
--- /dev/null
+++ b/ext/reflection/tests/ReflectionAttribute_constructor_001.phpt
@@ -0,0 +1,25 @@
+--TEST--
+ReflectionAttribute cannot be instantiated directly
+--FILE--
+<?php
+#[Attribute]
+class A {}
+
+class Foo {
+    #[A]
+    public function bar() {}
+}
+
+$rm = new ReflectionMethod(Foo::class, "bar");
+$attribute = $rm->getAttributes()[0];
+
+$rm = new ReflectionMethod($attribute, "__construct");
+
+try {
+    var_dump($rm->invoke($attribute, 0, 1, 2));
+} catch (ReflectionException $exception) {
+    echo $exception->getMessage();
+}
+?>
+--EXPECT--
+Cannot directly instantiate ReflectionAttribute