Check for append to $GLOBALS

Fixes oss-fuzz #29389.

diff --git a/Zend/tests/restrict_globals/invalid_append.phpt b/Zend/tests/restrict_globals/invalid_append.phpt
new file mode 100644 (file)
index 0000000..8e8b99f
--- /dev/null
+++ b/Zend/tests/restrict_globals/invalid_append.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Cannot append to $GLOBALS
+--FILE--
+<?php
+
+$GLOBALS[] = 1;
+
+?>
+--EXPECTF--
+Fatal error: Cannot append to $GLOBALS in %s on line %d

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 58cd190b6842131ab6b2830efd3e4e0701f6f510..06c0034bc2275e6a7e40d73fc3109c77ee3b4b23 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -2773,6 +2773,10 @@ static zend_op *zend_delayed_compile_dim(znode *result, zend_ast *ast, uint32_t
        znode var_node, dim_node;
 
        if (is_globals_fetch(var_ast)) {
+               if (dim_ast == NULL) {
+                       zend_error_noreturn(E_COMPILE_ERROR, "Cannot append to $GLOBALS");
+               }
+
                zend_compile_expr(&dim_node, dim_ast);
                if (dim_node.op_type == IS_CONST) {
                        convert_to_string(&dim_node.u.constant);