Fix write-mode of overloaded objects when using array dimensions

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 5e8209e3d2256b47943339a8e7ed2bac5c0f615b..611769554923c44eb966f1415fa65ed049cc06f5 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -911,26 +911,24 @@ static void zend_fetch_dimension_address(znode *result, znode *op1, znode *op2,
                        }
                        break;
                case IS_OBJECT:
-                       if (type == BP_VAR_R || type == BP_VAR_RW) {
-                               if (!Z_OBJ_HT_P(container)->read_dimension) {
-                                       zend_error(E_ERROR, "Cannot use object as array");
-                               } else {
-                                       zval *dim = get_zval_ptr(op2, Ts, &EG(free_op2), BP_VAR_R);
-                                       zval *overloaded_result = Z_OBJ_HT_P(container)->read_dimension(container, dim TSRMLS_CC);
+                       if (!Z_OBJ_HT_P(container)->read_dimension) {
+                               zend_error(E_ERROR, "Cannot use object as array");
+                       } else {
+                               zval *dim = get_zval_ptr(op2, Ts, &EG(free_op2), BP_VAR_R);
+                               zval *overloaded_result = Z_OBJ_HT_P(container)->read_dimension(container, dim, type TSRMLS_CC);
 
-                                       if (overloaded_result) {
-                                               if (type == BP_VAR_RW && !overloaded_result->is_ref) {
-                                                       zend_error(E_ERROR, "Objects used as arrays in post/pre increment/decrement must return values by reference");
-                                               }
-       
-                                               *retval = &overloaded_result;
-                                       } else {
-                                               *retval = &EG(error_zval_ptr);
+                               if (overloaded_result) {
+                                       if (type == BP_VAR_RW && !overloaded_result->is_ref) {
+                                               zend_error(E_ERROR, "Objects used as arrays in post/pre increment/decrement must return values by reference");
                                        }
-                                       AI_USE_PTR(T(result->u.var).var);
-                                       FREE_OP(Ts, op2, EG(free_op2));
-                                       SELECTIVE_PZVAL_LOCK(**retval, result);
+
+                                       *retval = &overloaded_result;
+                               } else {
+                                       *retval = &EG(error_zval_ptr);
                                }
+                               AI_USE_PTR(T(result->u.var).var);
+                               FREE_OP(Ts, op2, EG(free_op2));
+                               SELECTIVE_PZVAL_LOCK(**retval, result);
                        }
                        break;
                default: {
@@ -1559,7 +1557,7 @@ static inline int zend_binary_assign_op_obj_helper(int (*binary_op)(zval *result
                                        z = Z_OBJ_HT_P(object)->read_property(object, property, 0 TSRMLS_CC);
                                        break;
                                case ZEND_ASSIGN_DIM:
-                                       z = Z_OBJ_HT_P(object)->read_dimension(object, property TSRMLS_CC);
+                                       z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_W TSRMLS_CC);
                                        break;
                        }
                        SEPARATE_ZVAL_IF_NOT_REF(&z);

diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index 415b026b09bd29a0792205b9f045b67deb9fb28f..b578b97be87c79afa4510b9be16ae12b7a67bcd2 100644 (file)
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -373,7 +373,7 @@ static void zend_std_write_property(zval *object, zval *member, zval *value TSRM
        }
 }
 
-zval *zend_std_read_dimension(zval *object, zval *offset TSRMLS_DC)
+zval *zend_std_read_dimension(zval *object, zval *offset, int type TSRMLS_DC)
 {
        zend_class_entry *ce = Z_OBJCE_P(object);
        zval *retval;

diff --git a/Zend/zend_object_handlers.h b/Zend/zend_object_handlers.h
index 59a571c6f7d72746858e04106b966f998289077a..c8d04d1db99e612e237858a5744f7465c50d3568 100644 (file)
--- a/Zend/zend_object_handlers.h
+++ b/Zend/zend_object_handlers.h
@@ -28,7 +28,7 @@ union _zend_function;
 typedef zval *(*zend_object_read_property_t)(zval *object, zval *member, zend_bool silent TSRMLS_DC);
 
 /* Used to fetch dimension from the object, read-only */
-typedef zval *(*zend_object_read_dimension_t)(zval *object, zval *offset TSRMLS_DC);
+typedef zval *(*zend_object_read_dimension_t)(zval *object, zval *offset, int type TSRMLS_DC);
 
 /* Used to set property of the object */
 typedef void (*zend_object_write_property_t)(zval *object, zval *member, zval *value TSRMLS_DC);