MFB: fix #41813 (segmentation fault when using string offset as an object)

patch by judas dot iscariote at gmail dot com

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 0792be6e77673aeb820496a46b98d959162ed2bc..f632fe7d3b5c9a1fd50e587f90b9ce804c14b83f 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -552,6 +552,10 @@ static inline void zend_assign_to_object(znode *result, zval **object_ptr, znode
        zval *value = get_zval_ptr(value_op, Ts, &free_value, BP_VAR_R);
        zval **retval = &T(result->u.var).var.ptr;
 
+       if (!object_ptr) {
+               zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
+       }
+
        if (*object_ptr == EG(error_zval_ptr)) {
                FREE_OP(free_op2);
                if (!RETURN_VALUE_UNUSED(result)) {