cvs: ZendEngine2(PHP_5_1) / zend_vm_def.h zend_vm_execute.h zend_vm_opcodes.h /tests bug34064.phpt php-src NEWS

dmitry Wed Aug 10 06:39:56 2005 EDT Added files: (Branch: PHP_5_1) /ZendEngine2/tests bug34064.phpt Modified files: /php-src NEWS /ZendEngine2 zend_vm_def.h zend_vm_execute.h zend_vm_opcodes.h Log: Fixed bug #34064 (arr[] as param to function in class gives invalid opcode)

http://cvs.php.net/diff.php/php-src/NEWS?r1=1.2027.2.6&r2=1.2027.2.7&ty=u Index: php-src/NEWS diff -u php-src/NEWS:1.2027.2.6 php-src/NEWS:1.2027.2.7 --- php-src/NEWS:1.2027.2.6 Wed Aug 10 04:21:49 2005 +++ php-src/NEWS Wed Aug 10 06:39:52 2005 @@ -10,6 +10,8 @@ - Fixed "make test" to work for phpized extensions. (Hartmut, Jani) - Fixed failing queries (FALSE returned) with mysqli_query() on 64 bit systems. (Andrey) +- Fixed bug #34064 (arr[] as param to function in class gives invalid opcode). + (Dmitry) - Fixed bug #34045 (Buffer overflow with serialized object). (Dmitry) - Fixed bug #33999 (object remains object when cast to int). (Dmitry) - Fixed bug #33996 (No information given for fatal error on passing invalid http://cvs.php.net/diff.php/ZendEngine2/zend_vm_def.h?r1=1.59.2.1&r2=1.59.2.2&ty=u Index: ZendEngine2/zend_vm_def.h diff -u ZendEngine2/zend_vm_def.h:1.59.2.1 ZendEngine2/zend_vm_def.h:1.59.2.2 --- ZendEngine2/zend_vm_def.h:1.59.2.1 Wed Aug 10 02:37:16 2005 +++ ZendEngine2/zend_vm_def.h Wed Aug 10 06:39:53 2005 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_vm_def.h,v 1.59.2.1 2005/08/10 06:37:16 dmitry Exp $ */ +/* $Id: zend_vm_def.h,v 1.59.2.2 2005/08/10 10:39:53 dmitry Exp $ */ /* If you change this file, please regenerate the zend_vm_execute.h and * zend_vm_opcodes.h files by running: @@ -1051,7 +1051,7 @@ ZEND_VM_NEXT_OPCODE(); } -ZEND_VM_HANDLER(87, ZEND_FETCH_DIM_RW, VAR|CV, CONST|TMP|VAR|CV) +ZEND_VM_HANDLER(87, ZEND_FETCH_DIM_RW, VAR|CV, CONST|TMP|VAR|UNUSED|CV) { zend_op *opline = EX(opline); zend_free_op free_op1, free_op2; @@ -1075,13 +1075,17 @@ ZEND_VM_NEXT_OPCODE(); } -ZEND_VM_HANDLER(93, ZEND_FETCH_DIM_FUNC_ARG, VAR|CV, CONST|TMP|VAR|CV) +ZEND_VM_HANDLER(93, ZEND_FETCH_DIM_FUNC_ARG, VAR|CV, CONST|TMP|VAR|UNUSED|CV) { zend_op *opline = EX(opline); zend_free_op free_op1, free_op2; int type = ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->extended_value)?BP_VAR_W:BP_VAR_R; - zval *dim = GET_OP2_ZVAL_PTR(BP_VAR_R); - + zval *dim; + + if (OP2_TYPE == IS_UNUSED && type == BP_VAR_R) { + zend_error_noreturn(E_ERROR, "Cannot use [] for reading"); + } + dim = GET_OP2_ZVAL_PTR(BP_VAR_R); zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), GET_OP1_ZVAL_PTR_PTR(type), dim, IS_OP2_TMP_FREE(), type TSRMLS_CC); FREE_OP2(); FREE_OP1_VAR_PTR(); http://cvs.php.net/diff.php/ZendEngine2/zend_vm_execute.h?r1=1.62.2.1&r2=1.62.2.2&ty=u Index: ZendEngine2/zend_vm_execute.h diff -u ZendEngine2/zend_vm_execute.h:1.62.2.1 ZendEngine2/zend_vm_execute.h:1.62.2.2 --- ZendEngine2/zend_vm_execute.h:1.62.2.1 Wed Aug 10 02:37:16 2005 +++ ZendEngine2/zend_vm_execute.h Wed Aug 10 06:39:53 2005 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_vm_execute.h,v 1.62.2.1 2005/08/10 06:37:16 dmitry Exp $ */ +/* $Id: zend_vm_execute.h,v 1.62.2.2 2005/08/10 10:39:53 dmitry Exp $ */ static opcode_handler_t zend_user_opcode_handlers[256] = {(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL,(opcode_handler_t)NULL}; @@ -8529,8 +8529,12 @@ zend_op *opline = EX(opline); zend_free_op free_op1; int type = ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->extended_value)?BP_VAR_W:BP_VAR_R; - zval *dim = &opline->op2.u.constant; - + zval *dim; + + if (IS_CONST == IS_UNUSED && type == BP_VAR_R) { + zend_error_noreturn(E_ERROR, "Cannot use [] for reading"); + } + dim = &opline->op2.u.constant; zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC), dim, 0, type TSRMLS_CC); if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; @@ -9945,8 +9949,12 @@ zend_op *opline = EX(opline); zend_free_op free_op1, free_op2; int type = ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->extended_value)?BP_VAR_W:BP_VAR_R; - zval *dim = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); - + zval *dim; + + if (IS_TMP_VAR == IS_UNUSED && type == BP_VAR_R) { + zend_error_noreturn(E_ERROR, "Cannot use [] for reading"); + } + dim = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC), dim, 1, type TSRMLS_CC); zval_dtor(free_op2.var); if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; @@ -11364,8 +11372,12 @@ zend_op *opline = EX(opline); zend_free_op free_op1, free_op2; int type = ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->extended_value)?BP_VAR_W:BP_VAR_R; - zval *dim = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); - + zval *dim; + + if (IS_VAR == IS_UNUSED && type == BP_VAR_R) { + zend_error_noreturn(E_ERROR, "Cannot use [] for reading"); + } + dim = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC), dim, 0, type TSRMLS_CC); if (free_op2.var) {zval_ptr_dtor(&free_op2.var);}; if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; @@ -12359,6 +12371,35 @@ ZEND_VM_NEXT_OPCODE(); } +static int ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS) +{ + zend_op *opline = EX(opline); + zend_free_op free_op1; + zval *dim = NULL; + + zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC), dim, 0, BP_VAR_RW TSRMLS_CC); + + if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; + ZEND_VM_NEXT_OPCODE(); +} + +static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS) +{ + zend_op *opline = EX(opline); + zend_free_op free_op1; + int type = ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->extended_value)?BP_VAR_W:BP_VAR_R; + zval *dim; + + if (IS_UNUSED == IS_UNUSED && type == BP_VAR_R) { + zend_error_noreturn(E_ERROR, "Cannot use [] for reading"); + } + dim = NULL; + zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC), dim, 0, type TSRMLS_CC); + + if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; + ZEND_VM_NEXT_OPCODE(); +} + static int ZEND_ASSIGN_DIM_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); @@ -13199,8 +13240,12 @@ zend_op *opline = EX(opline); zend_free_op free_op1; int type = ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->extended_value)?BP_VAR_W:BP_VAR_R; - zval *dim = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC); - + zval *dim; + + if (IS_CV == IS_UNUSED && type == BP_VAR_R) { + zend_error_noreturn(E_ERROR, "Cannot use [] for reading"); + } + dim = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC); zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC), dim, 0, type TSRMLS_CC); if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; @@ -20424,8 +20469,12 @@ zend_op *opline = EX(opline); int type = ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->extended_value)?BP_VAR_W:BP_VAR_R; - zval *dim = &opline->op2.u.constant; - + zval *dim; + + if (IS_CONST == IS_UNUSED && type == BP_VAR_R) { + zend_error_noreturn(E_ERROR, "Cannot use [] for reading"); + } + dim = &opline->op2.u.constant; zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), type TSRMLS_CC), dim, 0, type TSRMLS_CC); @@ -21832,8 +21881,12 @@ zend_op *opline = EX(opline); zend_free_op free_op2; int type = ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->extended_value)?BP_VAR_W:BP_VAR_R; - zval *dim = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); - + zval *dim; + + if (IS_TMP_VAR == IS_UNUSED && type == BP_VAR_R) { + zend_error_noreturn(E_ERROR, "Cannot use [] for reading"); + } + dim = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), type TSRMLS_CC), dim, 1, type TSRMLS_CC); zval_dtor(free_op2.var); @@ -23243,8 +23296,12 @@ zend_op *opline = EX(opline); zend_free_op free_op2; int type = ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->extended_value)?BP_VAR_W:BP_VAR_R; - zval *dim = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); - + zval *dim; + + if (IS_VAR == IS_UNUSED && type == BP_VAR_R) { + zend_error_noreturn(E_ERROR, "Cannot use [] for reading"); + } + dim = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), type TSRMLS_CC), dim, 0, type TSRMLS_CC); if (free_op2.var) {zval_ptr_dtor(&free_op2.var);}; @@ -24229,6 +24286,35 @@ ZEND_VM_NEXT_OPCODE(); } +static int ZEND_FETCH_DIM_RW_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS) +{ + zend_op *opline = EX(opline); + + zval *dim = NULL; + + zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_RW TSRMLS_CC), dim, 0, BP_VAR_RW TSRMLS_CC); + + + ZEND_VM_NEXT_OPCODE(); +} + +static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS) +{ + zend_op *opline = EX(opline); + + int type = ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->extended_value)?BP_VAR_W:BP_VAR_R; + zval *dim; + + if (IS_UNUSED == IS_UNUSED && type == BP_VAR_R) { + zend_error_noreturn(E_ERROR, "Cannot use [] for reading"); + } + dim = NULL; + zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), type TSRMLS_CC), dim, 0, type TSRMLS_CC); + + + ZEND_VM_NEXT_OPCODE(); +} + static int ZEND_ASSIGN_DIM_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); @@ -25068,8 +25154,12 @@ zend_op *opline = EX(opline); int type = ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->extended_value)?BP_VAR_W:BP_VAR_R; - zval *dim = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC); - + zval *dim; + + if (IS_CV == IS_UNUSED && type == BP_VAR_R) { + zend_error_noreturn(E_ERROR, "Cannot use [] for reading"); + } + dim = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC); zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), type TSRMLS_CC), dim, 0, type TSRMLS_CC); @@ -27983,7 +28073,7 @@ ZEND_FETCH_DIM_RW_SPEC_VAR_CONST_HANDLER, ZEND_FETCH_DIM_RW_SPEC_VAR_TMP_HANDLER, ZEND_FETCH_DIM_RW_SPEC_VAR_VAR_HANDLER, - ZEND_NULL_HANDLER, + ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER, ZEND_FETCH_DIM_RW_SPEC_VAR_CV_HANDLER, ZEND_NULL_HANDLER, ZEND_NULL_HANDLER, @@ -27993,7 +28083,7 @@ ZEND_FETCH_DIM_RW_SPEC_CV_CONST_HANDLER, ZEND_FETCH_DIM_RW_SPEC_CV_TMP_HANDLER, ZEND_FETCH_DIM_RW_SPEC_CV_VAR_HANDLER, - ZEND_NULL_HANDLER, + ZEND_FETCH_DIM_RW_SPEC_CV_UNUSED_HANDLER, ZEND_FETCH_DIM_RW_SPEC_CV_CV_HANDLER, ZEND_NULL_HANDLER, ZEND_NULL_HANDLER, @@ -28133,7 +28223,7 @@ ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CONST_HANDLER, ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_TMP_HANDLER, ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_VAR_HANDLER, - ZEND_NULL_HANDLER, + ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER, ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CV_HANDLER, ZEND_NULL_HANDLER, ZEND_NULL_HANDLER, @@ -28143,7 +28233,7 @@ ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CONST_HANDLER, ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_TMP_HANDLER, ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_VAR_HANDLER, - ZEND_NULL_HANDLER, + ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_UNUSED_HANDLER, ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CV_HANDLER, ZEND_NULL_HANDLER, ZEND_NULL_HANDLER, http://cvs.php.net/diff.php/ZendEngine2/zend_vm_opcodes.h?r1=1.42&r2=1.42.2.1&ty=u Index: ZendEngine2/zend_vm_opcodes.h diff -u ZendEngine2/zend_vm_opcodes.h:1.42 ZendEngine2/zend_vm_opcodes.h:1.42.2.1 --- ZendEngine2/zend_vm_opcodes.h:1.42 Fri Aug 5 02:29:46 2005 +++ ZendEngine2/zend_vm_opcodes.h Wed Aug 10 06:39:54 2005 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_vm_opcodes.h,v 1.42 2005/08/05 06:29:46 dmitry Exp $ */ +/* $Id: zend_vm_opcodes.h,v 1.42.2.1 2005/08/10 10:39:54 dmitry Exp $ */ #define ZEND_NOP 0 #define ZEND_ADD 1 http://cvs.php.net/co.php/ZendEngine2/tests/bug34064.phpt?r=1.1&p=1 Index: ZendEngine2/tests/bug34064.phpt +++ ZendEngine2/tests/bug34064.phpt