diff --git a/NEWS b/NEWS index c398c49f84c..edca1748f63 100644 --- a/NEWS +++ b/NEWS @@ -12,6 +12,7 @@ PHP NEWS . Fixed bug GH-11601 (Incorrect handling of unwind and graceful exit exceptions). (ilutov) . Added zend_call_stack_get implementation for OpenBSD. (David Carlier) + . Fixed oss-fuzz #60411 (Fix double-compilation of arrow-functions). (ilutov) - LDAP: . Deprecate calling ldap_connect() with separate hostname and port. diff --git a/Zend/tests/oss_fuzz_60441.phpt b/Zend/tests/oss_fuzz_60441.phpt new file mode 100644 index 00000000000..7492a754ba0 --- /dev/null +++ b/Zend/tests/oss_fuzz_60441.phpt @@ -0,0 +1,11 @@ +--TEST-- +oss-fuzz #60441 (Double compilation of arrow function) +--FILE-- +y)[y]??=y; +?> +--EXPECTF-- +Fatal error: Uncaught Error: Undefined constant "y" in %s:%d +Stack trace: +#0 {main} + thrown in %s on line %d diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index 68cd9403f1e..e081ec67f90 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -7613,7 +7613,7 @@ static void zend_compile_func_decl(znode *result, zend_ast *ast, bool toplevel) zend_compile_closure_uses(uses_ast); } - if (ast->kind == ZEND_AST_ARROW_FUNC) { + if (ast->kind == ZEND_AST_ARROW_FUNC && decl->child[2]->kind != ZEND_AST_RETURN) { bool needs_return = true; if (op_array->fn_flags & ZEND_ACC_HAS_RETURN_TYPE) { zend_arg_info *return_info = CG(active_op_array)->arg_info - 1;