#41919 [Opn->Csd]: crash in string to array conversion

ID: 41919 Updated by: iliaa@php.net Reported By: judas dot iscariote at gmail dot com -Status: Open +Status: Closed Bug Type: Scripting Engine problem Operating System: all PHP Version: 5CVS-2007-07-08 (CVS) New Comment: This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2007-07-08 03:10:25] judas dot iscariote at gmail dot com Description: ------------ this is a variation of bug #41813 that produces segmentation fault as well.. Reproduce code: --------------- <?php $foo="50"; $foo[3]->bar[1] = "bang"; ?> Expected result: ---------------- Fatal error: Cannot use string offset as an array. Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. 0x000000000072e990 in zend_fetch_property_address (result=0x7fffc1e290a0, container_ptr=0x0, prop_ptr=0x2b8aecc303e8, type=1) patch: Index: Zend/zend_execute.c =================================================================== RCS file: /repository/ZendEngine2/zend_execute.c,v retrieving revision 1.716.2.12.2.21 diff -u -r1.716.2.12.2.21 zend_execute.c --- Zend/zend_execute.c 27 Jun 2007 08:51:40 -0000 1.716.2.12.2.21 +++ Zend/zend_execute.c 8 Jul 2007 03:07:33 -0000 @@ -1233,8 +1233,13 @@ static void zend_fetch_property_address(temp_variable *result, zval **container_ptr, zval *prop_ptr, int type TSRMLS_DC) { zval *container; + + if (!container_ptr) { + zend_error_noreturn(E_ERROR, "Cannot use string offset as an array"); + } container = *container_ptr; + if (container == EG(error_zval_ptr)) { if (result) { result->var.ptr_ptr = &EG(error_zval_ptr); ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=41919&edit=1