diff options
| -rw-r--r-- | Zend/tests/bug62653.phpt | 33 | ||||
| -rw-r--r-- | Zend/zend_vm_def.h | 3 | ||||
| -rw-r--r-- | Zend/zend_vm_execute.h | 36 |
3 files changed, 59 insertions, 13 deletions
diff --git a/Zend/tests/bug62653.phpt b/Zend/tests/bug62653.phpt new file mode 100644 index 0000000000..96299f16ea --- /dev/null +++ b/Zend/tests/bug62653.phpt @@ -0,0 +1,33 @@ +--TEST-- +Bug #62653: unset($array[$float]) causes a crash +--FILE-- +<?php +$array = array("5"=>"bar"); +$foo = "10.0000"; // gettype($foo) = "string" +$foo /= 2; //Makes $foo = 5 but still gettype($foo) = "double" +unset($array[$foo]); +print_r($array); + +$array = array("5"=>"bar"); +$foo = "5"; +unset($array[(float)$foo]); +print_r($array); + +$array = array("5"=>"bar"); +$foo = "10.0000"; +$foo /= 2; //Makes $foo = 5 but still gettype($foo) = "double" +$name = "foo"; +unset($array[$$name]); +print_r($array); + +?> +--EXPECT-- +Array +( +) +Array +( +) +Array +( +) diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index bc1591f582..5480698d9f 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -3956,7 +3956,8 @@ ZEND_VM_HANDLER(75, ZEND_UNSET_DIM, VAR|UNUSED|CV, CONST|TMP|VAR|CV) switch (Z_TYPE_P(offset)) { case IS_DOUBLE: hval = zend_dval_to_lval(Z_DVAL_P(offset)); - ZEND_VM_C_GOTO(num_index_dim); + zend_hash_index_del(ht, hval); + break; case IS_RESOURCE: case IS_BOOL: case IS_LONG: diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index e575f96928..5cedfbe343 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -14166,7 +14166,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HAND switch (Z_TYPE_P(offset)) { case IS_DOUBLE: hval = zend_dval_to_lval(Z_DVAL_P(offset)); - goto num_index_dim; + zend_hash_index_del(ht, hval); + break; case IS_RESOURCE: case IS_BOOL: case IS_LONG: @@ -16177,7 +16178,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLE switch (Z_TYPE_P(offset)) { case IS_DOUBLE: hval = zend_dval_to_lval(Z_DVAL_P(offset)); - goto num_index_dim; + zend_hash_index_del(ht, hval); + break; case IS_RESOURCE: case IS_BOOL: case IS_LONG: @@ -18398,7 +18400,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLE switch (Z_TYPE_P(offset)) { case IS_DOUBLE: hval = zend_dval_to_lval(Z_DVAL_P(offset)); - goto num_index_dim; + zend_hash_index_del(ht, hval); + break; case IS_RESOURCE: case IS_BOOL: case IS_LONG: @@ -21442,7 +21445,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER switch (Z_TYPE_P(offset)) { case IS_DOUBLE: hval = zend_dval_to_lval(Z_DVAL_P(offset)); - goto num_index_dim; + zend_hash_index_del(ht, hval); + break; case IS_RESOURCE: case IS_BOOL: case IS_LONG: @@ -22780,7 +22784,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_H switch (Z_TYPE_P(offset)) { case IS_DOUBLE: hval = zend_dval_to_lval(Z_DVAL_P(offset)); - goto num_index_dim; + zend_hash_index_del(ht, hval); + break; case IS_RESOURCE: case IS_BOOL: case IS_LONG: @@ -23938,7 +23943,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HAN switch (Z_TYPE_P(offset)) { case IS_DOUBLE: hval = zend_dval_to_lval(Z_DVAL_P(offset)); - goto num_index_dim; + zend_hash_index_del(ht, hval); + break; case IS_RESOURCE: case IS_BOOL: case IS_LONG: @@ -25096,7 +25102,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HAN switch (Z_TYPE_P(offset)) { case IS_DOUBLE: hval = zend_dval_to_lval(Z_DVAL_P(offset)); - goto num_index_dim; + zend_hash_index_del(ht, hval); + break; case IS_RESOURCE: case IS_BOOL: case IS_LONG: @@ -26520,7 +26527,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HAND switch (Z_TYPE_P(offset)) { case IS_DOUBLE: hval = zend_dval_to_lval(Z_DVAL_P(offset)); - goto num_index_dim; + zend_hash_index_del(ht, hval); + break; case IS_RESOURCE: case IS_BOOL: case IS_LONG: @@ -29783,7 +29791,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDL switch (Z_TYPE_P(offset)) { case IS_DOUBLE: hval = zend_dval_to_lval(Z_DVAL_P(offset)); - goto num_index_dim; + zend_hash_index_del(ht, hval); + break; case IS_RESOURCE: case IS_BOOL: case IS_LONG: @@ -31665,7 +31674,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER switch (Z_TYPE_P(offset)) { case IS_DOUBLE: hval = zend_dval_to_lval(Z_DVAL_P(offset)); - goto num_index_dim; + zend_hash_index_del(ht, hval); + break; case IS_RESOURCE: case IS_BOOL: case IS_LONG: @@ -33756,7 +33766,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER switch (Z_TYPE_P(offset)) { case IS_DOUBLE: hval = zend_dval_to_lval(Z_DVAL_P(offset)); - goto num_index_dim; + zend_hash_index_del(ht, hval); + break; case IS_RESOURCE: case IS_BOOL: case IS_LONG: @@ -36531,7 +36542,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ switch (Z_TYPE_P(offset)) { case IS_DOUBLE: hval = zend_dval_to_lval(Z_DVAL_P(offset)); - goto num_index_dim; + zend_hash_index_del(ht, hval); + break; case IS_RESOURCE: case IS_BOOL: case IS_LONG: |