diff options
| -rw-r--r-- | Zend/tests/bug54262.phpt | 17 | ||||
| -rw-r--r-- | Zend/zend_vm_def.h | 8 | ||||
| -rw-r--r-- | Zend/zend_vm_execute.h | 16 |
3 files changed, 29 insertions, 12 deletions
diff --git a/Zend/tests/bug54262.phpt b/Zend/tests/bug54262.phpt new file mode 100644 index 0000000000..24c7122fcd --- /dev/null +++ b/Zend/tests/bug54262.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #54262 (Crash when assigning value to a dimension in a non-array) +--FILE-- +<?php +$a = '0'; +var_dump(isset($a['b'])); +$simpleString = preg_match('//', '', $a->a); +$simpleString["wrong"] = "f"; +echo "ok\n"; +?> +--EXPECTF-- +bool(true) + +Warning: Attempt to modify property of non-object in %s/Zend/tests/bug54262.php on line 4 + +Warning: Cannot use a scalar value as an array in %s/Zend/tests/bug54262.php on line 5 +ok
\ No newline at end of file diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 79cff3e9ef..8de53845a5 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -3051,10 +3051,10 @@ ZEND_VM_HANDLER(67, ZEND_SEND_REF, VAR|CV, ANY) } if (OP1_TYPE == IS_VAR && UNEXPECTED(*varptr_ptr == &EG(error_zval))) { - Z_DELREF_PP(varptr_ptr); - ALLOC_ZVAL(*varptr_ptr); - INIT_ZVAL(**varptr_ptr); - Z_SET_REFCOUNT_PP(varptr_ptr, 0); + ALLOC_INIT_ZVAL(varptr); + zend_vm_stack_push(varptr TSRMLS_CC); + CHECK_EXCEPTION(); + ZEND_VM_NEXT_OPCODE(); } if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION && !ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->op2.opline_num)) { diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index ad210ab7d9..ea83b6f441 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -10621,10 +10621,10 @@ static int ZEND_FASTCALL ZEND_SEND_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARG } if (IS_VAR == IS_VAR && UNEXPECTED(*varptr_ptr == &EG(error_zval))) { - Z_DELREF_PP(varptr_ptr); - ALLOC_ZVAL(*varptr_ptr); - INIT_ZVAL(**varptr_ptr); - Z_SET_REFCOUNT_PP(varptr_ptr, 0); + ALLOC_INIT_ZVAL(varptr); + zend_vm_stack_push(varptr TSRMLS_CC); + CHECK_EXCEPTION(); + ZEND_VM_NEXT_OPCODE(); } if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION && !ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->op2.opline_num)) { @@ -26310,10 +26310,10 @@ static int ZEND_FASTCALL ZEND_SEND_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS } if (IS_CV == IS_VAR && UNEXPECTED(*varptr_ptr == &EG(error_zval))) { - Z_DELREF_PP(varptr_ptr); - ALLOC_ZVAL(*varptr_ptr); - INIT_ZVAL(**varptr_ptr); - Z_SET_REFCOUNT_PP(varptr_ptr, 0); + ALLOC_INIT_ZVAL(varptr); + zend_vm_stack_push(varptr TSRMLS_CC); + CHECK_EXCEPTION(); + ZEND_VM_NEXT_OPCODE(); } if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION && !ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->op2.opline_num)) { |