diff --git a/Zend/tests/str_offset_008.phpt b/Zend/tests/str_offset_008.phpt new file mode 100644 index 00000000000..e99e46e59e7 --- /dev/null +++ b/Zend/tests/str_offset_008.phpt @@ -0,0 +1,18 @@ +--TEST-- +string offset 008 indirect string modification by error handler +--FILE-- + +--EXPECT-- +Err: Undefined variable $b +Err: String offset cast occurred +string(1) "x" +int(8) diff --git a/ext/opcache/jit/zend_jit_helpers.c b/ext/opcache/jit/zend_jit_helpers.c index 590df087847..8ba9bdb2403 100644 --- a/ext/opcache/jit/zend_jit_helpers.c +++ b/ext/opcache/jit/zend_jit_helpers.c @@ -833,7 +833,15 @@ static zend_string* ZEND_FASTCALL zend_jit_fetch_dim_str_r_helper(zend_string *s zend_long offset; if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) { + if (!(GC_FLAGS(str) & IS_STR_INTERNED)) { + GC_ADDREF(str); + } offset = zend_check_string_offset(dim/*, BP_VAR_R*/); + if (!(GC_FLAGS(str) & IS_STR_INTERNED) && UNEXPECTED(GC_DELREF(str) == 0)) { + zend_string *ret = zend_jit_fetch_dim_str_offset(str, offset); + zend_string_efree(str); + return ret; + } } else { offset = Z_LVAL_P(dim); }