com php-src: Fixed bug #70182 (Segfault in ZEND_ASSIGN_OP handlers): NEWS Zend/tests/bug70182.phpt Zend/zend_execute.c

Commit: 9e246a73ef465f622050f8a166d35c5431df3bdd Author: Bob Weinand <bobwei9@hotmail.com> Sun, 2 Aug 2015 19:08:39 +0200 Parents: a7587135e3fad208b013319677320355a870ffe8 Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=9e246a73ef465f622050f8a166d35c5431df3bdd Log: Fixed bug #70182 (Segfault in ZEND_ASSIGN_OP handlers) Bugs: https://bugs.php.net/70182 Changed paths: M NEWS A Zend/tests/bug70182.phpt M Zend/zend_execute.c Diff: diff --git a/NEWS b/NEWS index ee77efb..2814b88 100644 --- a/NEWS +++ b/NEWS @@ -17,6 +17,7 @@ PHP NEWS . Fixed bug #69896 ('asm' operand has impossible constraints). (Anatol) . Fixed bug #70183 (null pointer deref (segfault) in zend_eval_const_expr). (Hugh Davenport) + . Fixed bug #70182 (Segfault in ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER). (Bob) - Curl: . Fixed bug #70163 (curl_setopt_array() type confusion). (Laruence) diff --git a/Zend/tests/bug70182.phpt b/Zend/tests/bug70182.phpt new file mode 100644 index 0000000..0b8111d --- /dev/null +++ b/Zend/tests/bug70182.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #70182 ($string[] assignment with +=) +--FILE-- +<?php + +$str = "abc"; +$str[] += $str; + +?> +--EXPECTF-- +Fatal error: Uncaught Error: [] operator not supported for strings in %sbug70182.php:%d +Stack trace: +#0 {main} + thrown in %sbug70182.php on line %d diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 065809f..3009ddf 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -1687,7 +1687,7 @@ convert_to_array: if (dim == NULL) { zend_throw_error(NULL, "[] operator not supported for strings"); - ZVAL_NULL(result); + ZVAL_INDIRECT(result, &EG(error_zval)); } else { zend_check_string_offset(dim, type); ZVAL_INDIRECT(result, NULL); /* wrong string offset */