Bugfix #25547

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 6d0111f93610562c45e2199b469c6d632f657cc4..5cf85d3478fce28afa221178de875d43d028520c 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -763,6 +763,8 @@ fetch_string_dim:
                                                retval = &EG(uninitialized_zval_ptr);
                                                break;
                                        case BP_VAR_RW:
+                                               offset_key = estrndup(offset_key, offset_key_length);
+                                               /* calling an user error handler may free zval dim, so we copy the string */
                                                zend_error(E_NOTICE,"Undefined index:  %s", offset_key);
                                                /* break missing intentionally */
                                        case BP_VAR_W: {
@@ -771,6 +773,9 @@ fetch_string_dim:
                                                        new_zval->refcount++;
                                                        zend_symtable_update(ht, offset_key, offset_key_length+1, &new_zval, sizeof(zval *), (void **) &retval);
                                                }
+                                               if (type == BP_VAR_RW) {
+                                                       efree(offset_key);
+                                               }
                                                break;
                                }
                        }