From fc3df283fb615337e3bf5877a6b80644cd1e458d Mon Sep 17 00:00:00 2001
From: George Peter Banyard <girgias@php.net>
Date: Wed, 2 Aug 2023 16:13:09 +0100
Subject: [PATCH] Zend: Fix memory leak in ++/-- when overloading fetch access

Closes GH-11859
---
 .../in-de-crement/overloaded_access.phpt      | 36 +++++++++++++++++++
 Zend/zend_vm_def.h                            | 14 --------
 Zend/zend_vm_execute.h                        | 28 ---------------
 3 files changed, 36 insertions(+), 42 deletions(-)
 create mode 100644 Zend/tests/in-de-crement/overloaded_access.phpt

diff --git a/Zend/tests/in-de-crement/overloaded_access.phpt b/Zend/tests/in-de-crement/overloaded_access.phpt
new file mode 100644
index 00000000000..56a5c2b1d47
--- /dev/null
+++ b/Zend/tests/in-de-crement/overloaded_access.phpt
@@ -0,0 +1,36 @@
+--TEST--
+Overloaded array access with pre increment/decrement
+--FILE--
+<?php
+set_error_handler(function($severity, $m) {
+	if (str_starts_with($m, 'Indirect modification of overloaded element')) { return; }
+	throw new Exception($m, $severity);
+});
+class Foo implements ArrayAccess {
+    function offsetGet($index): mixed {
+        return range(1, 5);
+    }
+    function offsetSet($index, $newval): void {
+    }
+    function offsetExists($index): bool {
+        return true;
+    }
+    function offsetUnset($index): void {
+    }
+}
+$foo = new Foo;
+try {
+	$foo[0]++;
+} catch (Throwable $ex) {
+	echo $ex->getMessage() . "\n";
+}
+$foo = new Foo;
+try {
+	$foo[0]--;
+} catch (Throwable $ex) {
+	echo $ex->getMessage() . "\n";
+}
+?>
+--EXPECT--
+Cannot increment array
+Cannot decrement array
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 1a950590200..46f5ee566b1 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1500,13 +1500,6 @@ ZEND_VM_HELPER(zend_pre_inc_helper, VAR|CV, ANY)
 			}
 		}
 		increment_function(var_ptr);
-		if (UNEXPECTED(EG(exception))) {
-			/* Smart branch expects result to be set with exceptions */
-			if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-				ZVAL_NULL(EX_VAR(opline->result.var));
-			}
-			HANDLE_EXCEPTION();
-		}
 	} while (0);
 
 	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
@@ -1559,13 +1552,6 @@ ZEND_VM_HELPER(zend_pre_dec_helper, VAR|CV, ANY)
 			}
 		}
 		decrement_function(var_ptr);
-		if (UNEXPECTED(EG(exception))) {
-			/* Smart branch expects result to be set with exceptions */
-			if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-				ZVAL_NULL(EX_VAR(opline->result.var));
-			}
-			HANDLE_EXCEPTION();
-		}
 	} while (0);
 
 	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 881dec2d9d3..cba0236ab5e 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -21624,13 +21624,6 @@ static zend_never_inline ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_pre_inc_help
 			}
 		}
 		increment_function(var_ptr);
-		if (UNEXPECTED(EG(exception))) {
-			/* Smart branch expects result to be set with exceptions */
-			if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-				ZVAL_NULL(EX_VAR(opline->result.var));
-			}
-			HANDLE_EXCEPTION();
-		}
 	} while (0);
 
 	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
@@ -21701,13 +21694,6 @@ static zend_never_inline ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_pre_dec_help
 			}
 		}
 		decrement_function(var_ptr);
-		if (UNEXPECTED(EG(exception))) {
-			/* Smart branch expects result to be set with exceptions */
-			if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-				ZVAL_NULL(EX_VAR(opline->result.var));
-			}
-			HANDLE_EXCEPTION();
-		}
 	} while (0);
 
 	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
@@ -39007,13 +38993,6 @@ static zend_never_inline ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_pre_inc_help
 			}
 		}
 		increment_function(var_ptr);
-		if (UNEXPECTED(EG(exception))) {
-			/* Smart branch expects result to be set with exceptions */
-			if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-				ZVAL_NULL(EX_VAR(opline->result.var));
-			}
-			HANDLE_EXCEPTION();
-		}
 	} while (0);
 
 	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
@@ -39083,13 +39062,6 @@ static zend_never_inline ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_pre_dec_help
 			}
 		}
 		decrement_function(var_ptr);
-		if (UNEXPECTED(EG(exception))) {
-			/* Smart branch expects result to be set with exceptions */
-			if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-				ZVAL_NULL(EX_VAR(opline->result.var));
-			}
-			HANDLE_EXCEPTION();
-		}
 	} while (0);
 
 	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {