diff options
| author | Moriyoshi Koizumi <moriyoshi@php.net> | 2003-12-03 19:10:38 +0000 |
|---|---|---|
| committer | Moriyoshi Koizumi <moriyoshi@php.net> | 2003-12-03 19:10:38 +0000 |
| commit | 7ac854e710feadd52f0c0e19c6f3515eaeb463a8 (patch) | |
| tree | e65dfc15f3526c4ea8aae3c8334a6ca171e54015 /Zend | |
| parent | 883815a9ec4bf168811b1a04c907cec735accd29 (diff) | |
| download | php-git-7ac854e710feadd52f0c0e19c6f3515eaeb463a8.tar.gz | |
Fix bug #24773 (unset()ing string offsets crashes PHP)
Diffstat (limited to 'Zend')
| -rw-r--r-- | Zend/zend_execute.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 4671d889d4..05063cbfe5 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -1946,11 +1946,15 @@ int zend_fetch_dim_unset_handler(ZEND_OPCODE_HANDLER_ARGS) } */ zend_fetch_dimension_address(&EX(opline)->result, &EX(opline)->op1, &EX(opline)->op2, EX(Ts), BP_VAR_R TSRMLS_CC); - PZVAL_UNLOCK(*EX_T(EX(opline)->result.u.var).var.ptr_ptr); - if (EX_T(EX(opline)->result.u.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) { - SEPARATE_ZVAL_IF_NOT_REF(EX_T(EX(opline)->result.u.var).var.ptr_ptr); + if (EX_T(EX(opline)->result.u.var).EA.type == IS_STRING_OFFSET) { + zend_error(E_WARNING, "Cannot unset string offsets"); + } else { + PZVAL_UNLOCK(*EX_T(EX(opline)->result.u.var).var.ptr_ptr); + if (EX_T(EX(opline)->result.u.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(EX_T(EX(opline)->result.u.var).var.ptr_ptr); + } + PZVAL_LOCK(*EX_T(EX(opline)->result.u.var).var.ptr_ptr); } - PZVAL_LOCK(*EX_T(EX(opline)->result.u.var).var.ptr_ptr); NEXT_OPCODE(); } |