diff --git a/Zend/tests/bug71300.phpt b/Zend/tests/bug71300.phpt new file mode 100644 index 00000000000..3589c4764e8 --- /dev/null +++ b/Zend/tests/bug71300.phpt @@ -0,0 +1,28 @@ +--TEST-- +Bug #71300 (Segfault in zend_fetch_string_offset) +--FILE-- + +--EXPECTF-- +string(4) "test" + +Notice: Array to string conversion in %sbug71300.php on line %d +string(9) "Arraytest" diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index 0384e8b5cf2..e9cc4bf84c3 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -2242,7 +2242,7 @@ static zend_op *zend_delayed_compile_end(uint32_t offset) /* {{{ */ zend_op *opline = NULL, *oplines = zend_stack_base(&CG(delayed_oplines_stack)); uint32_t i, count = zend_stack_count(&CG(delayed_oplines_stack)); - ZEND_ASSERT(count > offset); + ZEND_ASSERT(count >= offset); for (i = offset; i < count; ++i) { opline = get_next_op(CG(active_op_array)); memcpy(opline, &oplines[i], sizeof(zend_op)); @@ -2833,8 +2833,10 @@ void zend_compile_assign(znode *result, zend_ast *ast) /* {{{ */ switch (var_ast->kind) { case ZEND_AST_VAR: case ZEND_AST_STATIC_PROP: - zend_compile_var(&var_node, var_ast, BP_VAR_W); + offset = zend_delayed_compile_begin(); + zend_delayed_compile_var(&var_node, var_ast, BP_VAR_W); zend_compile_expr(&expr_node, expr_ast); + zend_delayed_compile_end(offset); zend_emit_op(result, ZEND_ASSIGN, &var_node, &expr_node); return; case ZEND_AST_DIM: @@ -2932,8 +2934,10 @@ void zend_compile_compound_assign(znode *result, zend_ast *ast) /* {{{ */ switch (var_ast->kind) { case ZEND_AST_VAR: case ZEND_AST_STATIC_PROP: - zend_compile_var(&var_node, var_ast, BP_VAR_RW); + offset = zend_delayed_compile_begin(); + zend_delayed_compile_var(&var_node, var_ast, BP_VAR_RW); zend_compile_expr(&expr_node, expr_ast); + zend_delayed_compile_end(offset); zend_emit_op(result, opcode, &var_node, &expr_node); return; case ZEND_AST_DIM: