[php-src] Issue #11580: Assert and ??= can lead to use-of-uninitialized-value due to memoization

From: Date: Mon, 03 Jul 2023 13:10:19 +0000
Subject: [php-src] Issue #11580: Assert and ??= can lead to use-of-uninitialized-value due to memoization
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-244867@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/11580 Author: iluuu1994 ### Description The following code: ```php <?php assert(y)[y] ??= y; ``` Resulted in this output: ``` $_main: ; (lines=26, args=0, vars=0, tmps=10) ; (before optimizer) ; /home/dmitry/tmp/fuzz-60129.php:1-3 ; return [] RANGE[0..0] 0000 V2 = ASSERT_CHECK 0007 0001 INIT_FCALL 2 112 string("assert") 0002 T0 = FETCH_CONSTANT string("y") 0003 T1 = COPY_TMP T0 0004 SEND_VAL T0 1 0005 SEND_VAL string("assert(y)") 2 0006 V2 = DO_ICALL 0007 T3 = FETCH_CONSTANT string("y") 0008 T4 = COPY_TMP T3 0009 T5 = FETCH_DIM_IS V2 T3 0010 T6 = COALESCE T5 0022 0011 T7 = FETCH_CONSTANT string("y") 0012 V8 = ASSERT_CHECK 0017 0013 INIT_FCALL 2 112 string("assert") 0014 SEND_VAL T1 1 ; <== T1 may be uninitialized here 0015 SEND_VAL string("assert(y)") 2 0016 V8 = DO_ICALL 0017 V8 = SEPARATE V8 0018 T9 = ASSIGN_DIM V8 T4 0019 OP_DATA T7 0020 T6 = QM_ASSIGN T9 0021 JMP 0024 0022 FREE T1 0023 FREE T4 0024 FREE T6 0025 RETURN int(1) ``` ### PHP Version PHP-8.1 ### Operating System _No response_

« previous php.bugs (#244867) next »