php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-15 03:51:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.4'

Browse Source 
* PHP-7.4:
  Fixed bug #79779
This commit is contained in:
Nikita Popov
2020-07-07 10:27:53 +02:00
parent 7da8c48a9b 6a9d934b2c
commit e0743d0f91
2 changed files with 24 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
Zend/tests/bug79779.phpt Normal file
View File

@@ -0,0 +1,12 @@
--TEST--
Bug #79779: Assertion failure when assigning property of string offset by reference
--FILE--
<?php
$str = "";
$str[1]->a = &$b;
?>
--EXPECTF--
Fatal error: Uncaught Error: Cannot use string offset as an object in %s:%d
Stack trace:
#0 {main}
thrown in %s on line %d

27
Zend/zend_execute.c
View File

@@ -1417,9 +1417,21 @@ static zend_never_inline ZEND_COLD void zend_wrong_string_offset(EXECUTE_DATA_D)
while (opline < end) {
if (opline->op1_type == IS_VAR && opline->op1.var == var) {
switch (opline->opcode) {
case ZEND_FETCH_OBJ_W:
case ZEND_FETCH_OBJ_RW:
case ZEND_FETCH_OBJ_FUNC_ARG:
case ZEND_FETCH_OBJ_UNSET:
case ZEND_ASSIGN_OBJ:
case ZEND_ASSIGN_OBJ_OP:
case ZEND_ASSIGN_OBJ_REF:
msg = "Cannot use string offset as an object";
break;
case ZEND_FETCH_DIM_W:
case ZEND_FETCH_DIM_RW:
case ZEND_FETCH_DIM_FUNC_ARG:
case ZEND_FETCH_DIM_UNSET:
case ZEND_FETCH_LIST_W:
case ZEND_ASSIGN_DIM:
case ZEND_ASSIGN_DIM_OP:
msg = "Cannot use string offset as an array";
break;
@@ -1437,21 +1449,6 @@ static zend_never_inline ZEND_COLD void zend_wrong_string_offset(EXECUTE_DATA_D)
case ZEND_POST_DEC:
msg = "Cannot increment/decrement string offsets";
break;
case ZEND_FETCH_DIM_W:
case ZEND_FETCH_DIM_RW:
case ZEND_FETCH_DIM_FUNC_ARG:
case ZEND_FETCH_DIM_UNSET:
case ZEND_FETCH_LIST_W:
case ZEND_ASSIGN_DIM:
msg = "Cannot use string offset as an array";
break;
case ZEND_FETCH_OBJ_W:
case ZEND_FETCH_OBJ_RW:
case ZEND_FETCH_OBJ_FUNC_ARG:
case ZEND_FETCH_OBJ_UNSET:
case ZEND_ASSIGN_OBJ:
msg = "Cannot use string offset as an object";
break;
case ZEND_ASSIGN_REF:
case ZEND_ADD_ARRAY_ELEMENT:
case ZEND_INIT_ARRAY: