Bug #75393 [Opn->Asn]: Crash when assign-adding an array to an object
| From: | bwoebi@php.net | Date: | Tue, 17 Oct 2017 00:21:12 +0000 |
| Subject: | Bug #75393 [Opn->Asn]: Crash when assign-adding an array to an object | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-211739@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=75393&edit=1
ID: 75393
Updated by: bwoebi@php.net
Reported by: bwoebi@php.net
Summary: Crash when assign-adding an array to an object
-Status: Open
+Status: Assigned
Type: Bug
Package: Reproducible crash
Operating System: Irrelevant
PHP Version: 7.0Git-2017-10-16 (Git)
-Assigned To:
+Assigned To: bwoebi
Block user comment: N
Private report: N
Previous Comments:
------------------------------------------------------------------------
[2017-10-17 00:21:00] bwoebi@php.net
Description:
------------
Assign-adding an array to an object leads to an use-after-free.
Test script:
---------------
$o = new stdClass;
$o += [];
Expected result:
----------------
Notice: Object of class stdClass could not be converted to int in - on line 1
Fatal error: Uncaught Error: Unsupported operand types in -:1
Stack trace:
#0 {main}
thrown in - on line 1
Actual result:
--------------
Invalid read
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=75393&edit=1