diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2020-07-07 10:27:53 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2020-07-07 10:27:53 +0200 |
| commit | e0743d0f91dab69672a38bf6eebb70b6ef091510 (patch) | |
| tree | 37fe347925eabc8bbe82779dd19179ed14e32e13 | |
| parent | 7da8c48a9b9e11b51c94fd4e99ea24619bcf2958 (diff) | |
| parent | 6a9d934b2ccde3e10d9a6cdf5927b539a937f1b0 (diff) | |
| download | php-git-e0743d0f91dab69672a38bf6eebb70b6ef091510.tar.gz | |
Merge branch 'PHP-7.4'
* PHP-7.4:
Fixed bug #79779
| -rw-r--r-- | Zend/tests/bug79779.phpt | 12 | ||||
| -rw-r--r-- | Zend/zend_execute.c | 27 |
2 files changed, 24 insertions, 15 deletions
diff --git a/Zend/tests/bug79779.phpt b/Zend/tests/bug79779.phpt new file mode 100644 index 0000000000..fe11ed76cc --- /dev/null +++ b/Zend/tests/bug79779.phpt @@ -0,0 +1,12 @@ +--TEST-- +Bug #79779: Assertion failure when assigning property of string offset by reference +--FILE-- +<?php +$str = ""; +$str[1]->a = &$b; +?> +--EXPECTF-- +Fatal error: Uncaught Error: Cannot use string offset as an object in %s:%d +Stack trace: +#0 {main} + thrown in %s on line %d diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 5df8345c76..4efb80bc72 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -1417,9 +1417,21 @@ static zend_never_inline ZEND_COLD void zend_wrong_string_offset(EXECUTE_DATA_D) while (opline < end) { if (opline->op1_type == IS_VAR && opline->op1.var == var) { switch (opline->opcode) { + case ZEND_FETCH_OBJ_W: + case ZEND_FETCH_OBJ_RW: + case ZEND_FETCH_OBJ_FUNC_ARG: + case ZEND_FETCH_OBJ_UNSET: + case ZEND_ASSIGN_OBJ: case ZEND_ASSIGN_OBJ_OP: + case ZEND_ASSIGN_OBJ_REF: msg = "Cannot use string offset as an object"; break; + case ZEND_FETCH_DIM_W: + case ZEND_FETCH_DIM_RW: + case ZEND_FETCH_DIM_FUNC_ARG: + case ZEND_FETCH_DIM_UNSET: + case ZEND_FETCH_LIST_W: + case ZEND_ASSIGN_DIM: case ZEND_ASSIGN_DIM_OP: msg = "Cannot use string offset as an array"; break; @@ -1437,21 +1449,6 @@ static zend_never_inline ZEND_COLD void zend_wrong_string_offset(EXECUTE_DATA_D) case ZEND_POST_DEC: msg = "Cannot increment/decrement string offsets"; break; - case ZEND_FETCH_DIM_W: - case ZEND_FETCH_DIM_RW: - case ZEND_FETCH_DIM_FUNC_ARG: - case ZEND_FETCH_DIM_UNSET: - case ZEND_FETCH_LIST_W: - case ZEND_ASSIGN_DIM: - msg = "Cannot use string offset as an array"; - break; - case ZEND_FETCH_OBJ_W: - case ZEND_FETCH_OBJ_RW: - case ZEND_FETCH_OBJ_FUNC_ARG: - case ZEND_FETCH_OBJ_UNSET: - case ZEND_ASSIGN_OBJ: - msg = "Cannot use string offset as an object"; - break; case ZEND_ASSIGN_REF: case ZEND_ADD_ARRAY_ELEMENT: case ZEND_INIT_ARRAY: |