php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-17 04:51:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.3' into PHP-7.4

Browse Source 
* PHP-7.3:
  Fix constant evaluation of && and ||
This commit is contained in:
Nikita Popov
2019-12-06 11:10:31 +01:00
parent 8753975418 249e49092d
commit 07fc0764d1
2 changed files with 26 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
Zend/tests/const_eval_and.phpt Normal file
View File

@@ -0,0 +1,9 @@
--TEST--
Incorrect constant evaluation of and/or (OSS-Fuzz #19255)
--FILE--
<?php
const C = 0 && __namespace__;
var_dump(C);
?>
--EXPECT--
bool(false)

31
Zend/zend_compile.c
View File

@@ -8778,25 +8778,28 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */
case ZEND_AST_AND:
case ZEND_AST_OR:
{
int i;
for (i = 0; i <= 1; i++) {
zend_eval_const_expr(&ast->child[i]);
if (ast->child[i]->kind == ZEND_AST_ZVAL) {
if (zend_is_true(zend_ast_get_zval(ast->child[i])) == (ast->kind == ZEND_AST_OR)) {
ZVAL_BOOL(&result, ast->kind == ZEND_AST_OR);
return;
}
}
}
if (ast->child[0]->kind != ZEND_AST_ZVAL || ast->child[1]->kind != ZEND_AST_ZVAL) {
zend_bool child0_is_true, child1_is_true;
zend_eval_const_expr(&ast->child[0]);
zend_eval_const_expr(&ast->child[1]);
if (ast->child[0]->kind != ZEND_AST_ZVAL) {
return;
}
child0_is_true = zend_is_true(zend_ast_get_zval(ast->child[0]));
if (child0_is_true == (ast->kind == ZEND_AST_OR)) {
ZVAL_BOOL(&result, ast->kind == ZEND_AST_OR);
break;
}
if (ast->child[1]->kind != ZEND_AST_ZVAL) {
return;
}
child1_is_true = zend_is_true(zend_ast_get_zval(ast->child[1]));
if (ast->kind == ZEND_AST_OR) {
ZVAL_BOOL(&result, zend_is_true(zend_ast_get_zval(ast->child[0])) || zend_is_true(zend_ast_get_zval(ast->child[1])));
ZVAL_BOOL(&result, child0_is_true || child1_is_true);
} else {
ZVAL_BOOL(&result, zend_is_true(zend_ast_get_zval(ast->child[0])) && zend_is_true(zend_ast_get_zval(ast->child[1])));
ZVAL_BOOL(&result, child0_is_true && child1_is_true);
}
break;
}