Fixed bug #41919

diff --git a/Zend/tests/bug41919.phpt b/Zend/tests/bug41919.phpt
new file mode 100644 (file)
index 0000000..3ba9ae0
--- /dev/null
+++ b/Zend/tests/bug41919.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #41919 (crash in string to array conversion)
+--FILE--
+<?php
+$foo="50";
+$foo[3]->bar[1] = "bang";
+
+echo "ok\n";
+?>
+--EXPECTF--
+Fatal error: Cannot use string offset as an object in %s/bug41919.php on line %d

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index f632fe7d3b5c9a1fd50e587f90b9ce804c14b83f..8a761db62ebe2770b7f1ff597acfac049cf592ad 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1239,6 +1239,10 @@ static void zend_fetch_property_address(temp_variable *result, zval **container_
 {
        zval *container;
 
+       if (!container_ptr) {
+               zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+       }
+
        container = *container_ptr;
        if (container == EG(error_zval_ptr)) {
                if (result) {