Detect self-addition of array more accurately

While the zvals may be different, they may still point to the
same array.

Fixes oss-fuzz #26245.

diff --git a/Zend/tests/array_self_add_globals.phpt b/Zend/tests/array_self_add_globals.phpt
new file mode 100644 (file)
index 0000000..ebad7c3
--- /dev/null
+++ b/Zend/tests/array_self_add_globals.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Add $GLOBALS to itself
+--FILE--
+<?php
+$GLOBALS += $GLOBALS;
+$x = $GLOBALS + $GLOBALS;
+?>
+===DONE===
+--EXPECT--
+===DONE===

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 45cdc1b11c9081afc4c64efbcfc4e6cf07f73a75..7338e471b65bed2337f76593507825a6ffb96763 100644 (file)
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -903,7 +903,7 @@ try_again:
 
 static zend_never_inline void ZEND_FASTCALL add_function_array(zval *result, zval *op1, zval *op2) /* {{{ */
 {
-       if ((result == op1) && (result == op2)) {
+       if (result == op1 && Z_ARR_P(op1) == Z_ARR_P(op2)) {
                /* $a += $a */
                return;
        }