Fix detection of write to built-in function for references

diff --git a/Zend/tests/builtin_in_write_context_error1.phpt b/Zend/tests/builtin_in_write_context_error1.phpt
new file mode 100644 (file)
index 0000000..eed03cc
--- /dev/null
+++ b/Zend/tests/builtin_in_write_context_error1.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Cannot use built-in functions in write context (assignment)
+--FILE--
+<?php
+
+strlen("foo")[0] = 1;
+
+?>
+--EXPECTF--
+Fatal error: Cannot use result of built-in function in write context in %s on line %d

diff --git a/Zend/tests/builtin_in_write_context_error2.phpt b/Zend/tests/builtin_in_write_context_error2.phpt
new file mode 100644 (file)
index 0000000..aac23e4
--- /dev/null
+++ b/Zend/tests/builtin_in_write_context_error2.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Cannot use built-in functions in write context (reference)
+--FILE--
+<?php
+
+$ref =& strlen("foo");
+
+?>
+--EXPECTF--
+Fatal error: Cannot use result of built-in function in write context in %s on line %d

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 189d68344659c541af936762f23581a86f781cc9..73f6a8b00827786303fe87fff9cd9a46f0895433 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -2322,6 +2322,10 @@ void zend_compile_assign_ref(znode *result, zend_ast *ast TSRMLS_DC) /* {{{ */
        zend_compile_var(&target_node, target_ast, BP_VAR_W TSRMLS_CC);
        zend_compile_var(&source_node, source_ast, BP_VAR_REF TSRMLS_CC);
 
+       if (source_node.op_type != IS_VAR && zend_is_call(source_ast)) {
+               zend_error_noreturn(E_COMPILE_ERROR, "Cannot use result of built-in function in write context");
+       }
+
        opline = zend_emit_op(result, ZEND_ASSIGN_REF, &target_node, &source_node TSRMLS_CC);
        if (!result) {
                opline->result_type |= EXT_TYPE_UNUSED;