It's not possible to create reference to string-offset

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index efc7c6c3a7718ac1e0fe1d9ac2ad5ed112db4a95..2a89da2a5eedd76e81838defb5da7971d9948dc0 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1205,17 +1205,19 @@ ZEND_VM_HANDLER(84, ZEND_FETCH_DIM_W, VAR|CV, CONST|TMP|VAR|UNUSED|CV)
        if (UNEXPECTED(opline->extended_value != 0)) {
                zval *retval_ptr = EX_VAR(opline->result.var);
 
-               if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
-                       retval_ptr = Z_INDIRECT_P(retval_ptr);
-               }
-               if (!Z_ISREF_P(retval_ptr)) {
-                       if (Z_REFCOUNTED_P(retval_ptr)) {
-                               Z_DELREF_P(retval_ptr);
-                               SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
-                       } else {
-                               ZVAL_NEW_REF(retval_ptr, retval_ptr);
+               if (Z_TYPE_P(retval_ptr) != IS_STR_OFFSET) {
+                       if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
+                               retval_ptr = Z_INDIRECT_P(retval_ptr);
+                       }
+                       if (!Z_ISREF_P(retval_ptr)) {
+                               if (Z_REFCOUNTED_P(retval_ptr)) {
+                                       Z_DELREF_P(retval_ptr);
+                                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
+                               } else {
+                                       ZVAL_NEW_REF(retval_ptr, retval_ptr);
+                               }
+                               Z_ADDREF_P(retval_ptr);
                        }
-                       Z_ADDREF_P(retval_ptr);
                }
        }
 

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 2c4c322c6670e5c74375cef7815b34716183d207..6ec59ac6c7df31f104eb45eab89b6c6e0fb7eced 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -14543,17 +14543,19 @@ static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HA
        if (UNEXPECTED(opline->extended_value != 0)) {
                zval *retval_ptr = EX_VAR(opline->result.var);
 
-               if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
-                       retval_ptr = Z_INDIRECT_P(retval_ptr);
-               }
-               if (!Z_ISREF_P(retval_ptr)) {
-                       if (Z_REFCOUNTED_P(retval_ptr)) {
-                               Z_DELREF_P(retval_ptr);
-                               SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
-                       } else {
-                               ZVAL_NEW_REF(retval_ptr, retval_ptr);
+               if (Z_TYPE_P(retval_ptr) != IS_STR_OFFSET) {
+                       if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
+                               retval_ptr = Z_INDIRECT_P(retval_ptr);
+                       }
+                       if (!Z_ISREF_P(retval_ptr)) {
+                               if (Z_REFCOUNTED_P(retval_ptr)) {
+                                       Z_DELREF_P(retval_ptr);
+                                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
+                               } else {
+                                       ZVAL_NEW_REF(retval_ptr, retval_ptr);
+                               }
+                               Z_ADDREF_P(retval_ptr);
                        }
-                       Z_ADDREF_P(retval_ptr);
                }
        }
 
@@ -16836,17 +16838,19 @@ static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HAND
        if (UNEXPECTED(opline->extended_value != 0)) {
                zval *retval_ptr = EX_VAR(opline->result.var);
 
-               if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
-                       retval_ptr = Z_INDIRECT_P(retval_ptr);
-               }
-               if (!Z_ISREF_P(retval_ptr)) {
-                       if (Z_REFCOUNTED_P(retval_ptr)) {
-                               Z_DELREF_P(retval_ptr);
-                               SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
-                       } else {
-                               ZVAL_NEW_REF(retval_ptr, retval_ptr);
+               if (Z_TYPE_P(retval_ptr) != IS_STR_OFFSET) {
+                       if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
+                               retval_ptr = Z_INDIRECT_P(retval_ptr);
+                       }
+                       if (!Z_ISREF_P(retval_ptr)) {
+                               if (Z_REFCOUNTED_P(retval_ptr)) {
+                                       Z_DELREF_P(retval_ptr);
+                                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
+                               } else {
+                                       ZVAL_NEW_REF(retval_ptr, retval_ptr);
+                               }
+                               Z_ADDREF_P(retval_ptr);
                        }
-                       Z_ADDREF_P(retval_ptr);
                }
        }
 
@@ -19026,17 +19030,19 @@ static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HAND
        if (UNEXPECTED(opline->extended_value != 0)) {
                zval *retval_ptr = EX_VAR(opline->result.var);
 
-               if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
-                       retval_ptr = Z_INDIRECT_P(retval_ptr);
-               }
-               if (!Z_ISREF_P(retval_ptr)) {
-                       if (Z_REFCOUNTED_P(retval_ptr)) {
-                               Z_DELREF_P(retval_ptr);
-                               SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
-                       } else {
-                               ZVAL_NEW_REF(retval_ptr, retval_ptr);
+               if (Z_TYPE_P(retval_ptr) != IS_STR_OFFSET) {
+                       if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
+                               retval_ptr = Z_INDIRECT_P(retval_ptr);
+                       }
+                       if (!Z_ISREF_P(retval_ptr)) {
+                               if (Z_REFCOUNTED_P(retval_ptr)) {
+                                       Z_DELREF_P(retval_ptr);
+                                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
+                               } else {
+                                       ZVAL_NEW_REF(retval_ptr, retval_ptr);
+                               }
+                               Z_ADDREF_P(retval_ptr);
                        }
-                       Z_ADDREF_P(retval_ptr);
                }
        }
 
@@ -20954,17 +20960,19 @@ static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_H
        if (UNEXPECTED(opline->extended_value != 0)) {
                zval *retval_ptr = EX_VAR(opline->result.var);
 
-               if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
-                       retval_ptr = Z_INDIRECT_P(retval_ptr);
-               }
-               if (!Z_ISREF_P(retval_ptr)) {
-                       if (Z_REFCOUNTED_P(retval_ptr)) {
-                               Z_DELREF_P(retval_ptr);
-                               SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
-                       } else {
-                               ZVAL_NEW_REF(retval_ptr, retval_ptr);
+               if (Z_TYPE_P(retval_ptr) != IS_STR_OFFSET) {
+                       if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
+                               retval_ptr = Z_INDIRECT_P(retval_ptr);
+                       }
+                       if (!Z_ISREF_P(retval_ptr)) {
+                               if (Z_REFCOUNTED_P(retval_ptr)) {
+                                       Z_DELREF_P(retval_ptr);
+                                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
+                               } else {
+                                       ZVAL_NEW_REF(retval_ptr, retval_ptr);
+                               }
+                               Z_ADDREF_P(retval_ptr);
                        }
-                       Z_ADDREF_P(retval_ptr);
                }
        }
 
@@ -22402,17 +22410,19 @@ static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDL
        if (UNEXPECTED(opline->extended_value != 0)) {
                zval *retval_ptr = EX_VAR(opline->result.var);
 
-               if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
-                       retval_ptr = Z_INDIRECT_P(retval_ptr);
-               }
-               if (!Z_ISREF_P(retval_ptr)) {
-                       if (Z_REFCOUNTED_P(retval_ptr)) {
-                               Z_DELREF_P(retval_ptr);
-                               SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
-                       } else {
-                               ZVAL_NEW_REF(retval_ptr, retval_ptr);
+               if (Z_TYPE_P(retval_ptr) != IS_STR_OFFSET) {
+                       if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
+                               retval_ptr = Z_INDIRECT_P(retval_ptr);
+                       }
+                       if (!Z_ISREF_P(retval_ptr)) {
+                               if (Z_REFCOUNTED_P(retval_ptr)) {
+                                       Z_DELREF_P(retval_ptr);
+                                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
+                               } else {
+                                       ZVAL_NEW_REF(retval_ptr, retval_ptr);
+                               }
+                               Z_ADDREF_P(retval_ptr);
                        }
-                       Z_ADDREF_P(retval_ptr);
                }
        }
 
@@ -31598,17 +31608,19 @@ static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HAN
        if (UNEXPECTED(opline->extended_value != 0)) {
                zval *retval_ptr = EX_VAR(opline->result.var);
 
-               if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
-                       retval_ptr = Z_INDIRECT_P(retval_ptr);
-               }
-               if (!Z_ISREF_P(retval_ptr)) {
-                       if (Z_REFCOUNTED_P(retval_ptr)) {
-                               Z_DELREF_P(retval_ptr);
-                               SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
-                       } else {
-                               ZVAL_NEW_REF(retval_ptr, retval_ptr);
+               if (Z_TYPE_P(retval_ptr) != IS_STR_OFFSET) {
+                       if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
+                               retval_ptr = Z_INDIRECT_P(retval_ptr);
+                       }
+                       if (!Z_ISREF_P(retval_ptr)) {
+                               if (Z_REFCOUNTED_P(retval_ptr)) {
+                                       Z_DELREF_P(retval_ptr);
+                                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
+                               } else {
+                                       ZVAL_NEW_REF(retval_ptr, retval_ptr);
+                               }
+                               Z_ADDREF_P(retval_ptr);
                        }
-                       Z_ADDREF_P(retval_ptr);
                }
        }
 
@@ -33673,17 +33685,19 @@ static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDL
        if (UNEXPECTED(opline->extended_value != 0)) {
                zval *retval_ptr = EX_VAR(opline->result.var);
 
-               if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
-                       retval_ptr = Z_INDIRECT_P(retval_ptr);
-               }
-               if (!Z_ISREF_P(retval_ptr)) {
-                       if (Z_REFCOUNTED_P(retval_ptr)) {
-                               Z_DELREF_P(retval_ptr);
-                               SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
-                       } else {
-                               ZVAL_NEW_REF(retval_ptr, retval_ptr);
+               if (Z_TYPE_P(retval_ptr) != IS_STR_OFFSET) {
+                       if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
+                               retval_ptr = Z_INDIRECT_P(retval_ptr);
+                       }
+                       if (!Z_ISREF_P(retval_ptr)) {
+                               if (Z_REFCOUNTED_P(retval_ptr)) {
+                                       Z_DELREF_P(retval_ptr);
+                                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
+                               } else {
+                                       ZVAL_NEW_REF(retval_ptr, retval_ptr);
+                               }
+                               Z_ADDREF_P(retval_ptr);
                        }
-                       Z_ADDREF_P(retval_ptr);
                }
        }
 
@@ -35738,17 +35752,19 @@ static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDL
        if (UNEXPECTED(opline->extended_value != 0)) {
                zval *retval_ptr = EX_VAR(opline->result.var);
 
-               if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
-                       retval_ptr = Z_INDIRECT_P(retval_ptr);
-               }
-               if (!Z_ISREF_P(retval_ptr)) {
-                       if (Z_REFCOUNTED_P(retval_ptr)) {
-                               Z_DELREF_P(retval_ptr);
-                               SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
-                       } else {
-                               ZVAL_NEW_REF(retval_ptr, retval_ptr);
+               if (Z_TYPE_P(retval_ptr) != IS_STR_OFFSET) {
+                       if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
+                               retval_ptr = Z_INDIRECT_P(retval_ptr);
+                       }
+                       if (!Z_ISREF_P(retval_ptr)) {
+                               if (Z_REFCOUNTED_P(retval_ptr)) {
+                                       Z_DELREF_P(retval_ptr);
+                                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
+                               } else {
+                                       ZVAL_NEW_REF(retval_ptr, retval_ptr);
+                               }
+                               Z_ADDREF_P(retval_ptr);
                        }
-                       Z_ADDREF_P(retval_ptr);
                }
        }
 
@@ -37540,17 +37556,19 @@ static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HA
        if (UNEXPECTED(opline->extended_value != 0)) {
                zval *retval_ptr = EX_VAR(opline->result.var);
 
-               if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
-                       retval_ptr = Z_INDIRECT_P(retval_ptr);
-               }
-               if (!Z_ISREF_P(retval_ptr)) {
-                       if (Z_REFCOUNTED_P(retval_ptr)) {
-                               Z_DELREF_P(retval_ptr);
-                               SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
-                       } else {
-                               ZVAL_NEW_REF(retval_ptr, retval_ptr);
+               if (Z_TYPE_P(retval_ptr) != IS_STR_OFFSET) {
+                       if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
+                               retval_ptr = Z_INDIRECT_P(retval_ptr);
+                       }
+                       if (!Z_ISREF_P(retval_ptr)) {
+                               if (Z_REFCOUNTED_P(retval_ptr)) {
+                                       Z_DELREF_P(retval_ptr);
+                                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
+                               } else {
+                                       ZVAL_NEW_REF(retval_ptr, retval_ptr);
+                               }
+                               Z_ADDREF_P(retval_ptr);
                        }
-                       Z_ADDREF_P(retval_ptr);
                }
        }
 
@@ -38854,17 +38872,19 @@ static int ZEND_FASTCALL  ZEND_FETCH_DIM_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLE
        if (UNEXPECTED(opline->extended_value != 0)) {
                zval *retval_ptr = EX_VAR(opline->result.var);
 
-               if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
-                       retval_ptr = Z_INDIRECT_P(retval_ptr);
-               }
-               if (!Z_ISREF_P(retval_ptr)) {
-                       if (Z_REFCOUNTED_P(retval_ptr)) {
-                               Z_DELREF_P(retval_ptr);
-                               SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
-                       } else {
-                               ZVAL_NEW_REF(retval_ptr, retval_ptr);
+               if (Z_TYPE_P(retval_ptr) != IS_STR_OFFSET) {
+                       if (Z_TYPE_P(retval_ptr) == IS_INDIRECT) {
+                               retval_ptr = Z_INDIRECT_P(retval_ptr);
+                       }
+                       if (!Z_ISREF_P(retval_ptr)) {
+                               if (Z_REFCOUNTED_P(retval_ptr)) {
+                                       Z_DELREF_P(retval_ptr);
+                                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr);
+                               } else {
+                                       ZVAL_NEW_REF(retval_ptr, retval_ptr);
+                               }
+                               Z_ADDREF_P(retval_ptr);
                        }
-                       Z_ADDREF_P(retval_ptr);
                }
        }