diff options
author | Xinchen Hui <laruence@gmail.com> | 2018-06-27 13:05:11 +0800 |
---|---|---|
committer | Xinchen Hui <laruence@gmail.com> | 2018-06-27 13:05:11 +0800 |
commit | d1b1866a3a035b946e50b17eeefd19add81c7eab (patch) | |
tree | 7ead754956797c40fb68a7f3b26d3872532b1fb7 | |
parent | 6b5597f7d8e31933dfb833dd443290adc02ca307 (diff) | |
download | php-git-d1b1866a3a035b946e50b17eeefd19add81c7eab.tar.gz |
Fixed bug #76534 (PHP hangs on 'illegal string offset on string references with an error handler)
-rw-r--r-- | NEWS | 2 | ||||
-rw-r--r-- | Zend/tests/bug76534.phpt | 17 | ||||
-rw-r--r-- | Zend/zend_execute.c | 4 | ||||
-rw-r--r-- | Zend/zend_vm_def.h | 4 | ||||
-rw-r--r-- | Zend/zend_vm_execute.h | 32 |
5 files changed, 49 insertions, 10 deletions
@@ -3,6 +3,8 @@ PHP NEWS ?? ??? ????, PHP 7.1.20 - Core: + . Fixed bug #76534 (PHP hangs on 'illegal string offset on string references + with an error handler). (Laruence) . Fixed bug #76502 (Chain of mixed exceptions and errors does not serialize properly). (Nikita) diff --git a/Zend/tests/bug76534.phpt b/Zend/tests/bug76534.phpt new file mode 100644 index 0000000000..956a29ba2c --- /dev/null +++ b/Zend/tests/bug76534.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #76534 (PHP hangs on 'illegal string offset on string references with an error handler) +--FILE-- +<?php +set_error_handler(function ($severity, $message, $file, $line) { + throw new \Exception($message); +}); + +$x = "foo"; +$y = &$x["bar"]; +?> +--EXPECTF-- +Fatal error: Uncaught Exception: Illegal string offset 'bar' in %sbug76534.php:%d +Stack trace: +#0 %sbug76534.php(%d): {closure}(2, 'Illegal string ...', '%s', %d, Array) +#1 {main} + thrown in %sbug76534.php on line %d diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 968618a6aa..f88fac6c88 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -1700,7 +1700,9 @@ fetch_from_array: zend_throw_error(NULL, "[] operator not supported for strings"); } else { zend_check_string_offset(dim, type); - zend_wrong_string_offset(); + if (EXPECTED(EG(exception) == NULL)) { + zend_wrong_string_offset(); + } } ZVAL_ERROR(result); } else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) { diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 7dd70fa709..ea9870d31b 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -891,7 +891,9 @@ ZEND_VM_C_LABEL(assign_dim_op_convert_to_array): zend_throw_error(NULL, "[] operator not supported for strings"); } else { zend_check_string_offset(dim, BP_VAR_RW); - zend_wrong_string_offset(); + if (EXPECTED(EG(exception) == NULL)) { + zend_wrong_string_offset(); + } } } else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) { ZEND_VM_C_GOTO(assign_dim_op_convert_to_array); diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index cb20546da9..af3c181552 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -17596,7 +17596,9 @@ assign_dim_op_convert_to_array: zend_throw_error(NULL, "[] operator not supported for strings"); } else { zend_check_string_offset(dim, BP_VAR_RW); - zend_wrong_string_offset(); + if (EXPECTED(EG(exception) == NULL)) { + zend_wrong_string_offset(); + } } } else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) { goto assign_dim_op_convert_to_array; @@ -21014,7 +21016,9 @@ assign_dim_op_convert_to_array: zend_throw_error(NULL, "[] operator not supported for strings"); } else { zend_check_string_offset(dim, BP_VAR_RW); - zend_wrong_string_offset(); + if (EXPECTED(EG(exception) == NULL)) { + zend_wrong_string_offset(); + } } } else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) { goto assign_dim_op_convert_to_array; @@ -22385,7 +22389,9 @@ assign_dim_op_convert_to_array: zend_throw_error(NULL, "[] operator not supported for strings"); } else { zend_check_string_offset(dim, BP_VAR_RW); - zend_wrong_string_offset(); + if (EXPECTED(EG(exception) == NULL)) { + zend_wrong_string_offset(); + } } } else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) { goto assign_dim_op_convert_to_array; @@ -25330,7 +25336,9 @@ assign_dim_op_convert_to_array: zend_throw_error(NULL, "[] operator not supported for strings"); } else { zend_check_string_offset(dim, BP_VAR_RW); - zend_wrong_string_offset(); + if (EXPECTED(EG(exception) == NULL)) { + zend_wrong_string_offset(); + } } } else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) { goto assign_dim_op_convert_to_array; @@ -37055,7 +37063,9 @@ assign_dim_op_convert_to_array: zend_throw_error(NULL, "[] operator not supported for strings"); } else { zend_check_string_offset(dim, BP_VAR_RW); - zend_wrong_string_offset(); + if (EXPECTED(EG(exception) == NULL)) { + zend_wrong_string_offset(); + } } } else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) { goto assign_dim_op_convert_to_array; @@ -41665,7 +41675,9 @@ assign_dim_op_convert_to_array: zend_throw_error(NULL, "[] operator not supported for strings"); } else { zend_check_string_offset(dim, BP_VAR_RW); - zend_wrong_string_offset(); + if (EXPECTED(EG(exception) == NULL)) { + zend_wrong_string_offset(); + } } } else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) { goto assign_dim_op_convert_to_array; @@ -44149,7 +44161,9 @@ assign_dim_op_convert_to_array: zend_throw_error(NULL, "[] operator not supported for strings"); } else { zend_check_string_offset(dim, BP_VAR_RW); - zend_wrong_string_offset(); + if (EXPECTED(EG(exception) == NULL)) { + zend_wrong_string_offset(); + } } } else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) { goto assign_dim_op_convert_to_array; @@ -48220,7 +48234,9 @@ assign_dim_op_convert_to_array: zend_throw_error(NULL, "[] operator not supported for strings"); } else { zend_check_string_offset(dim, BP_VAR_RW); - zend_wrong_string_offset(); + if (EXPECTED(EG(exception) == NULL)) { + zend_wrong_string_offset(); + } } } else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) { goto assign_dim_op_convert_to_array; |