com php-src: Fixed bug #70183 null pointer deref (segfault) in zend_eval_const_expr: Zend/tests/bug70183 .phpt Zend/zend_compile.c

Commit: 2a1a8f9ea75d4c8c9c47c2a391113764b9d0639b Author: Hugh Davenport <hugh@allthethings.co.nz> Sun, 2 Aug 2015 16:51:23 +0200 Committer: Anatol Belski <ab@php.net> Sun, 2 Aug 2015 16:51:23 +0200 Parents: 8e528b2792f7cfbcd2cdbd6de7f158fdc82ed89f Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=2a1a8f9ea75d4c8c9c47c2a391113764b9d0639b Log: Fixed bug #70183 null pointer deref (segfault) in zend_eval_const_expr Bugs: https://bugs.php.net/70183 Changed paths: A Zend/tests/bug70183.phpt M Zend/zend_compile.c Diff: diff --git a/Zend/tests/bug70183.phpt b/Zend/tests/bug70183.phpt new file mode 100644 index 0000000..d9b9972 --- /dev/null +++ b/Zend/tests/bug70183.phpt @@ -0,0 +1,8 @@ +--TEST-- +Bug #70183 (null pointer deref (segfault) in zend_eval_const_expr) +--FILE-- +<?php +[[][]] +?> +--EXPECTF-- +Fatal error: Cannot use [] for reading in %sbug70183.php on line %d diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index 5d7eec2..0e9f478 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -7374,7 +7374,7 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */ zend_eval_const_expr(&ast->child[0]); zend_eval_const_expr(&ast->child[1]); - if (ast->child[0]->kind != ZEND_AST_ZVAL || ast->child[1]->kind != ZEND_AST_ZVAL) { + if (!ast->child[0] || !ast->child[1] || ast->child[0]->kind != ZEND_AST_ZVAL || ast->child[1]->kind != ZEND_AST_ZVAL) { return; }