From a5d3620d937f69665d78ab8d21c757d3db17b5ec Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita.ppv@gmail.com>
Date: Wed, 2 Oct 2019 12:06:00 +0200
Subject: Fix segfault with __COMPILER_HALT_OFFSET__ and trailing {}

Fixes OSS-Fuzz #17895.
---
 Zend/tests/halt_compiler5.phpt | 8 ++++++++
 Zend/zend_compile.c            | 3 +++
 2 files changed, 11 insertions(+)
 create mode 100644 Zend/tests/halt_compiler5.phpt

(limited to 'Zend')

diff --git a/Zend/tests/halt_compiler5.phpt b/Zend/tests/halt_compiler5.phpt
new file mode 100644
index 0000000000..71d973e4f7
--- /dev/null
+++ b/Zend/tests/halt_compiler5.phpt
@@ -0,0 +1,8 @@
+--TEST--
+Using __COMPILER_HALF_OFFSET__ with trailing {} (OSS-Fuzz #17895)
+--FILE--
+<?php
+__COMPILER_HALT_OFFSET__;
+{}
+--EXPECTF--
+Warning: Use of undefined constant __COMPILER_HALT_OFFSET__ - assumed '__COMPILER_HALT_OFFSET__' (this will throw an Error in a future version of PHP) in %s on line %d
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index f25ce2f55d..d991bbcf38 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -7676,6 +7676,9 @@ void zend_compile_const(znode *result, zend_ast *ast) /* {{{ */
 
 		while (last && last->kind == ZEND_AST_STMT_LIST) {
 			zend_ast_list *list = zend_ast_get_list(last);
+			if (list->children == 0) {
+				break;
+			}
 			last = list->child[list->children-1];
 		}
 		if (last && last->kind == ZEND_AST_HALT_COMPILER) {
-- 
cgit v1.2.1