diff options
| author | Dmitry Stogov <dmitry@zend.com> | 2015-06-23 16:26:40 +0300 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@zend.com> | 2015-06-23 16:26:40 +0300 |
| commit | 7a01c44ab268820c2365798fde0fe010cf6c5e20 (patch) | |
| tree | 74279232a334f52d98423bceb356bef7d69e99f3 /Zend/zend_execute.c | |
| parent | 36d39b70443dcefeeb62d189ce67b414caf5486a (diff) | |
| download | php-git-7a01c44ab268820c2365798fde0fe010cf6c5e20.tar.gz | |
Fixed bug #69905 (null ptr deref and segfault in ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER)
Diffstat (limited to 'Zend/zend_execute.c')
| -rw-r--r-- | Zend/zend_execute.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 246372fee2..8fc40245c9 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -1682,11 +1682,11 @@ convert_to_array: if (dim == NULL) { zend_error(E_EXCEPTION | E_ERROR, "[] operator not supported for strings"); + ZVAL_NULL(result); } else { zend_check_string_offset(dim, type); + ZVAL_INDIRECT(result, NULL); /* wrong string offset */ } - - ZVAL_INDIRECT(result, NULL); /* wrong string offset */ } else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) { if (!Z_OBJ_HT_P(container)->read_dimension) { zend_error(E_EXCEPTION | E_ERROR, "Cannot use object as array"); |