Fix handling of nullsafe method in empty()

Fixes oss-fuzz #24627.

diff --git a/Zend/tests/nullsafe_operator/030.phpt b/Zend/tests/nullsafe_operator/030.phpt
new file mode 100644 (file)
index 0000000..7bff0b2
--- /dev/null
+++ b/Zend/tests/nullsafe_operator/030.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Empty on nullsafe method
+--FILE--
+<?php
+
+class Test {
+    public function method($value) {
+        return $value;
+    }
+}
+
+$null = null;
+var_dump(empty($null?->method()));
+$test = new Test;
+var_dump(empty($test?->method(false)));
+var_dump(empty($test?->method(42)));
+
+?>
+--EXPECT--
+bool(true)
+bool(true)
+bool(false)

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 78b72de1a7e07b37ca85c522ad065b5121f170aa..5e61760e9029e98c6b5af3987b704be24f17a745 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -8684,7 +8684,6 @@ void zend_compile_isset_or_empty(znode *result, zend_ast *ast) /* {{{ */
 
        ZEND_ASSERT(ast->kind == ZEND_AST_ISSET || ast->kind == ZEND_AST_EMPTY);
 
-       zend_short_circuiting_mark_inner(var_ast);
        if (!zend_is_variable(var_ast)) {
                if (ast->kind == ZEND_AST_EMPTY) {
                        /* empty(expr) can be transformed to !expr */
@@ -8698,6 +8697,7 @@ void zend_compile_isset_or_empty(znode *result, zend_ast *ast) /* {{{ */
                }
        }
 
+       zend_short_circuiting_mark_inner(var_ast);
        switch (var_ast->kind) {
                case ZEND_AST_VAR:
                        if (is_this_fetch(var_ast)) {