fix #41813 (segmentation fault when using string offset as an object)

patch by judas dot iscariote at gmail dot com

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 7c75aad71965fb3e2f63ea6d76b259e3617b6319..6214837cd2a0a667eff928f4a8f2555442279ee0 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -530,6 +530,10 @@ static inline void zend_assign_to_object(znode *result, zval **object_ptr, znode
        zval *value = get_zval_ptr(value_op, Ts, &free_value, BP_VAR_R);
        zval **retval = &T(result->u.var).var.ptr;
 
+       if (!object_ptr) {
+               zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
+       }
+
        if (*object_ptr == EG(error_zval_ptr)) {
                FREE_OP(free_op2);
                if (!RETURN_VALUE_UNUSED(result)) {