php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 08:12:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix type inference

Browse Source 
Fixes oss-fuzz #49423 and #49474
This commit is contained in:
Dmitry Stogov
2022-07-25 15:53:06 +03:00
parent e70d282077
commit d50875c822
2 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
Zend/Optimizer/zend_inference.c
View File

@@ -1942,6 +1942,9 @@ static uint32_t assign_dim_array_result_type(
tmp |= MAY_BE_HASH_ONLY(arr_type) ? MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
} else {
if (dim_type & (MAY_BE_LONG|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_RESOURCE|MAY_BE_DOUBLE)) {
if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
tmp |= MAY_BE_ARRAY_PACKED;
}
tmp |= MAY_BE_HASH_ONLY(arr_type) ? MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
}
if (dim_type & MAY_BE_STRING) {

19
ext/opcache/tests/opt/inference_014.phpt Normal file
View File

@@ -0,0 +1,19 @@
--TEST--
Type inference 014: ASSIGN_DIM_OP
--INI--
opcache.enable=1
opcache.enable_cli=1
opcache.optimization_level=-1
--FILE--
<?php
function y() {
for(;;){
$x[y] &= y;
$x = false;
$x[""]=y;
}
}
?>
DONE
--EXPECT--
DONE