Fix segfault when empty entry in keyed array assignment

diff --git a/Zend/tests/list_empty_error_keyed.phpt b/Zend/tests/list_empty_error_keyed.phpt
new file mode 100644 (file)
index 0000000..f363d24
--- /dev/null
+++ b/Zend/tests/list_empty_error_keyed.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Cannot use empty elements in keyed array destructuring
+--FILE--
+<?php
+
+$array = ['a' => 1, 'b' => 2];
+['a' => $a, , 'b' => $b] = $array;
+
+?>
+--EXPECTF--
+Fatal error: Cannot use empty array entries in keyed array assignment in %s on line %d

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 4978c6c1c9c820d994e2c73669529930a705f761..1501acec1e9b6d2fd2db2ef689dc763d816635e7 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -2853,15 +2853,20 @@ static void zend_compile_keyed_list_assign(zend_ast_list *list, znode *expr_node
        uint32_t i;
 
        for (i = 0; i < list->children; ++i) {
-               zend_ast *pair_ast = list->child[i];
-               zend_ast *var_ast = pair_ast->child[0];
-               zend_ast *key_ast = pair_ast->child[1];
+               zend_ast *elem_ast = list->child[i];
+               zend_ast *var_ast, *key_ast;
                znode fetch_result, dim_node;
 
-               if (pair_ast->attr) {
+               if (elem_ast == NULL) {
+                       zend_error(E_COMPILE_ERROR, "Cannot use empty array entries in keyed array assignment");
+               }
+               if (elem_ast->attr) {
                        zend_error(E_COMPILE_ERROR, "[] and list() assignments cannot be by reference");
                }
 
+               var_ast = elem_ast->child[0];
+               key_ast = elem_ast->child[1];
+
                if (key_ast == NULL) {
                        zend_error(E_COMPILE_ERROR, "Cannot mix keyed and unkeyed array entries in assignments");
                }
@@ -2872,10 +2877,6 @@ static void zend_compile_keyed_list_assign(zend_ast_list *list, znode *expr_node
                        Z_TRY_ADDREF(expr_node->u.constant);
                }
 
-               if (var_ast == NULL) {
-                       zend_error(E_COMPILE_ERROR, "Cannot use empty array entries in keyed array");
-               }
-
                zend_verify_list_assign_target(var_ast, old_style);
 
                zend_emit_op(&fetch_result, ZEND_FETCH_LIST, expr_node, &dim_node);