- Fixed bug #50255 (isset() and empty() silently casts array to object)

diff --git a/NEWS b/NEWS
index 3123fd35f6470810e7b1a7a4a8a9306fa594c41a..0c8ea4a60d64f5d92c443787722d86d8ab94eb12 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,8 @@ PHP                                                                        NEWS
 
 - Fixed bug #50282 (xmlrpc_encode_request() changes object into array in 
   calling function). (Felipe)
+- Fixed bug #50255 (isset() and empty() silently casts array to object).
+  (Felipe)
 - Fixed bug #50219 (soap call Segmentation fault on a redirected url).
   (Pierrick)
 - Fixed bug #50207 (segmentation fault when concatenating very large strings

diff --git a/Zend/tests/bug50255.phpt b/Zend/tests/bug50255.phpt
new file mode 100644 (file)
index 0000000..9f390af
--- /dev/null
+++ b/Zend/tests/bug50255.phpt
@@ -0,0 +1,30 @@
+--TEST--
+Bug #50255 (isset() and empty() silently casts array to object)
+--FILE--
+<?php
+
+$arr = array('foo' => 'bar');
+
+print "isset\n";
+var_dump(isset($arr->foo));
+var_dump(isset($arr->bar));
+var_dump(isset($arr['foo']));
+var_dump(isset($arr['bar']));
+print "empty\n";
+var_dump(empty($arr->foo));
+var_dump(empty($arr->bar));
+var_dump(empty($arr['foo']));
+var_dump(empty($arr['bar']));
+
+?>
+--EXPECT--
+isset
+bool(false)
+bool(false)
+bool(true)
+bool(false)
+empty
+bool(true)
+bool(true)
+bool(false)
+bool(true)

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 499d539d98e6e0b7bcbb66258016bf31fc5da0f0..0431d80854caac3b7410fd091436bd40c8e254fc 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3532,7 +3532,7 @@ ZEND_VM_HELPER_EX(zend_isset_isempty_dim_prop_obj_handler, VAR|UNUSED|CV, CONST|
                zend_free_op free_op2;
                zval *offset = GET_OP2_ZVAL_PTR(BP_VAR_R);
 
-               if (Z_TYPE_PP(container) == IS_ARRAY) {
+               if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
                        HashTable *ht;
                        int isset = 0;
 

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index f2863a6ddd7f1c7a650c27976470cf8fbf14c174..9aa59ff2b13e27edb385a4ea3d199cf5398605b6 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -9750,7 +9750,7 @@ static int zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CONST(int prop_dim,
 
                zval *offset = &opline->op2.u.constant;
 
-               if (Z_TYPE_PP(container) == IS_ARRAY) {
+               if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
                        HashTable *ht;
                        int isset = 0;
 
@@ -11283,7 +11283,7 @@ static int zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_TMP(int prop_dim, ZE
                zend_free_op free_op2;
                zval *offset = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC);
 
-               if (Z_TYPE_PP(container) == IS_ARRAY) {
+               if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
                        HashTable *ht;
                        int isset = 0;
 
@@ -12864,7 +12864,7 @@ static int zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_VAR(int prop_dim, ZE
                zend_free_op free_op2;
                zval *offset = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC);
 
-               if (Z_TYPE_PP(container) == IS_ARRAY) {
+               if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
                        HashTable *ht;
                        int isset = 0;
 
@@ -14890,7 +14890,7 @@ static int zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CV(int prop_dim, ZEN
 
                zval *offset = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC);
 
-               if (Z_TYPE_PP(container) == IS_ARRAY) {
+               if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
                        HashTable *ht;
                        int isset = 0;
 
@@ -16009,7 +16009,7 @@ static int zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CONST(int prop_di
 
                zval *offset = &opline->op2.u.constant;
 
-               if (Z_TYPE_PP(container) == IS_ARRAY) {
+               if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
                        HashTable *ht;
                        int isset = 0;
 
@@ -17002,7 +17002,7 @@ static int zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_TMP(int prop_dim,
                zend_free_op free_op2;
                zval *offset = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC);
 
-               if (Z_TYPE_PP(container) == IS_ARRAY) {
+               if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
                        HashTable *ht;
                        int isset = 0;
 
@@ -17995,7 +17995,7 @@ static int zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_VAR(int prop_dim,
                zend_free_op free_op2;
                zval *offset = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC);
 
-               if (Z_TYPE_PP(container) == IS_ARRAY) {
+               if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
                        HashTable *ht;
                        int isset = 0;
 
@@ -19256,7 +19256,7 @@ static int zend_isset_isempty_dim_prop_obj_handler_SPEC_UNUSED_CV(int prop_dim,
 
                zval *offset = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC);
 
-               if (Z_TYPE_PP(container) == IS_ARRAY) {
+               if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
                        HashTable *ht;
                        int isset = 0;
 
@@ -22018,7 +22018,7 @@ static int zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CONST(int prop_dim, Z
 
                zval *offset = &opline->op2.u.constant;
 
-               if (Z_TYPE_PP(container) == IS_ARRAY) {
+               if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
                        HashTable *ht;
                        int isset = 0;
 
@@ -23543,7 +23543,7 @@ static int zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_TMP(int prop_dim, ZEN
                zend_free_op free_op2;
                zval *offset = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC);
 
-               if (Z_TYPE_PP(container) == IS_ARRAY) {
+               if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
                        HashTable *ht;
                        int isset = 0;
 
@@ -25115,7 +25115,7 @@ static int zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_VAR(int prop_dim, ZEN
                zend_free_op free_op2;
                zval *offset = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC);
 
-               if (Z_TYPE_PP(container) == IS_ARRAY) {
+               if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
                        HashTable *ht;
                        int isset = 0;
 
@@ -27131,7 +27131,7 @@ static int zend_isset_isempty_dim_prop_obj_handler_SPEC_CV_CV(int prop_dim, ZEND
 
                zval *offset = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC);
 
-               if (Z_TYPE_PP(container) == IS_ARRAY) {
+               if (Z_TYPE_PP(container) == IS_ARRAY && !prop_dim) {
                        HashTable *ht;
                        int isset = 0;