From 013bb5769be38b74c8cf4a82044e8eaf21ebacd7 Mon Sep 17 00:00:00 2001
From: George Peter Banyard <girgias@php.net>
Date: Mon, 21 Aug 2023 15:01:46 +0100
Subject: [PATCH] Add tests for oss-fuzz-61469: Undef dynamic property in ++/--
 unset in error handler

This was fixed as a consequence of a3a3964497922bcd74282685218d90acea69c296

Closes GH-12011
---
 ..._dynamic_property_unset_error_handler.phpt | 16 ++++++++++++++++
 ..._dynamic_property_unset_error_handler.phpt | 19 +++++++++++++++++++
 ..._dynamic_property_unset_error_handler.phpt | 19 +++++++++++++++++++
 ..._dynamic_property_unset_error_handler.phpt | 16 ++++++++++++++++
 ..._dynamic_property_unset_error_handler.phpt | 16 ++++++++++++++++
 5 files changed, 86 insertions(+)
 create mode 100644 Zend/tests/in-de-crement/oss-fuzz-61469_binop_dynamic_property_unset_error_handler.phpt
 create mode 100644 Zend/tests/in-de-crement/oss-fuzz-61469_postdec_dynamic_property_unset_error_handler.phpt
 create mode 100644 Zend/tests/in-de-crement/oss-fuzz-61469_postinc_dynamic_property_unset_error_handler.phpt
 create mode 100644 Zend/tests/in-de-crement/oss-fuzz-61469_predec_dynamic_property_unset_error_handler.phpt
 create mode 100644 Zend/tests/in-de-crement/oss-fuzz-61469_preinc_dynamic_property_unset_error_handler.phpt

diff --git a/Zend/tests/in-de-crement/oss-fuzz-61469_binop_dynamic_property_unset_error_handler.phpt b/Zend/tests/in-de-crement/oss-fuzz-61469_binop_dynamic_property_unset_error_handler.phpt
new file mode 100644
index 00000000000..7c3e7044ad5
--- /dev/null
+++ b/Zend/tests/in-de-crement/oss-fuzz-61469_binop_dynamic_property_unset_error_handler.phpt
@@ -0,0 +1,16 @@
+--TEST--
+OSS Fuzz #61469: Undef variable in ++/-- for dynamic property that is unset in error handler
+--FILE--
+<?php
+class C {
+    function errorHandle() {
+        unset($this->a);
+    }
+}
+$c = new C;
+set_error_handler([$c,'errorHandle']);
+$c->a += 5;
+var_dump($c->a);
+?>
+--EXPECT--
+int(5)
diff --git a/Zend/tests/in-de-crement/oss-fuzz-61469_postdec_dynamic_property_unset_error_handler.phpt b/Zend/tests/in-de-crement/oss-fuzz-61469_postdec_dynamic_property_unset_error_handler.phpt
new file mode 100644
index 00000000000..4db0011fb52
--- /dev/null
+++ b/Zend/tests/in-de-crement/oss-fuzz-61469_postdec_dynamic_property_unset_error_handler.phpt
@@ -0,0 +1,19 @@
+--TEST--
+OSS Fuzz #61469: Undef variable in ++/-- for dynamic property that is unset in error handler
+--FILE--
+<?php
+class C {
+    function errorHandle() {
+        unset($this->a);
+    }
+}
+$c = new C;
+set_error_handler([$c,'errorHandle']);
+
+$v = ($c->a--);
+var_dump($c->a);
+var_dump($v);
+?>
+--EXPECT--
+NULL
+NULL
diff --git a/Zend/tests/in-de-crement/oss-fuzz-61469_postinc_dynamic_property_unset_error_handler.phpt b/Zend/tests/in-de-crement/oss-fuzz-61469_postinc_dynamic_property_unset_error_handler.phpt
new file mode 100644
index 00000000000..4db0011fb52
--- /dev/null
+++ b/Zend/tests/in-de-crement/oss-fuzz-61469_postinc_dynamic_property_unset_error_handler.phpt
@@ -0,0 +1,19 @@
+--TEST--
+OSS Fuzz #61469: Undef variable in ++/-- for dynamic property that is unset in error handler
+--FILE--
+<?php
+class C {
+    function errorHandle() {
+        unset($this->a);
+    }
+}
+$c = new C;
+set_error_handler([$c,'errorHandle']);
+
+$v = ($c->a--);
+var_dump($c->a);
+var_dump($v);
+?>
+--EXPECT--
+NULL
+NULL
diff --git a/Zend/tests/in-de-crement/oss-fuzz-61469_predec_dynamic_property_unset_error_handler.phpt b/Zend/tests/in-de-crement/oss-fuzz-61469_predec_dynamic_property_unset_error_handler.phpt
new file mode 100644
index 00000000000..10c6f0acb07
--- /dev/null
+++ b/Zend/tests/in-de-crement/oss-fuzz-61469_predec_dynamic_property_unset_error_handler.phpt
@@ -0,0 +1,16 @@
+--TEST--
+OSS Fuzz #61469: Undef variable in ++/-- for dynamic property that is unset in error handler
+--FILE--
+<?php
+class C {
+    function errorHandle() {
+        unset($this->a);
+    }
+}
+$c = new C;
+set_error_handler([$c,'errorHandle']);
+(--$c->a);
+var_dump($c->a);
+?>
+--EXPECT--
+NULL
diff --git a/Zend/tests/in-de-crement/oss-fuzz-61469_preinc_dynamic_property_unset_error_handler.phpt b/Zend/tests/in-de-crement/oss-fuzz-61469_preinc_dynamic_property_unset_error_handler.phpt
new file mode 100644
index 00000000000..26c5eb4e0b1
--- /dev/null
+++ b/Zend/tests/in-de-crement/oss-fuzz-61469_preinc_dynamic_property_unset_error_handler.phpt
@@ -0,0 +1,16 @@
+--TEST--
+OSS Fuzz #61469: Undef variable in ++/-- for dynamic property that is unset in error handler
+--FILE--
+<?php
+class C {
+    function errorHandle() {
+        unset($this->a);
+    }
+}
+$c = new C;
+set_error_handler([$c,'errorHandle']);
+(++$c->a);
+var_dump($c->a);
+?>
+--EXPECT--
+int(1)