Bugfix #29882 isset crashes on arrays

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 862ba578f2b14465634f8534342229c35b251a10..1911912003a824b90a30ef05d322eb0c80889876 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -763,6 +763,9 @@ void zend_do_end_variable_parse(int type, int arg_offset TSRMLS_DC)
                                opline->opcode += 3;
                                break;
                        case BP_VAR_IS:
+                               if (opline->opcode == ZEND_FETCH_DIM_W && opline->op2.op_type == IS_UNUSED) {
+                                       zend_error(E_COMPILE_ERROR, "Cannot use [] for reading");
+                               }
                                opline->opcode += 6; /* 3+3 */
                                break;
                        case BP_VAR_FUNC_ARG: