fix #41351 (Invalid opcode with foreach ($a[] as $b))

diff --git a/Zend/tests/bug41351.phpt b/Zend/tests/bug41351.phpt
new file mode 100644 (file)
index 0000000..62af6a0
--- /dev/null
+++ b/Zend/tests/bug41351.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #41351 (Invalid opcode with foreach ($a[] as $b))
+--FILE--
+<?php
+
+$a = array();
+
+foreach($a[] as $b) {
+}
+
+echo "Done\n";
+?>
+--EXPECTF--    
+Fatal error: Cannot use [] for reading in %s on line %d

diff --git a/Zend/tests/bug41351_2.phpt b/Zend/tests/bug41351_2.phpt
new file mode 100644 (file)
index 0000000..7009eaa
--- /dev/null
+++ b/Zend/tests/bug41351_2.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #41351 (Invalid opcode with foreach ($a[] as $b)) - 2
+--FILE--
+<?php
+
+$a = array();
+
+foreach($a[]['test'] as $b) {
+}
+
+echo "Done\n";
+?>
+--EXPECTF--    
+Fatal error: Cannot use [] for reading in %s on line %d

diff --git a/Zend/tests/bug41351_3.phpt b/Zend/tests/bug41351_3.phpt
new file mode 100644 (file)
index 0000000..9cb2388
--- /dev/null
+++ b/Zend/tests/bug41351_3.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #41351 (Invalid opcode with foreach ($a[] as $b)) - 3
+--FILE--
+<?php
+
+$a = array();
+
+foreach($a['test'][] as $b) {
+}
+
+echo "Done\n";
+?>
+--EXPECTF--    
+Fatal error: Cannot use [] for reading in %s on line %d

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index ff045941d50908c8f914d940395ecf4f20a27b40..18644d10763a38b9642178eca9a567e9a0f78f11 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -4034,7 +4034,11 @@ void zend_do_foreach_cont(znode *foreach_token, znode *open_brackets_token, znod
                /* Change "write context" into "read context" */
                fetch->extended_value = 0;  /* reset ZEND_FE_RESET_VARIABLE */
                while (fetch != end) {
-                       (--fetch)->opcode -= 3; /* FETCH_W -> FETCH_R */
+                       --fetch;
+                       if (fetch->opcode == ZEND_FETCH_DIM_W && fetch->op2.op_type == IS_UNUSED) {
+                               zend_error(E_COMPILE_ERROR, "Cannot use [] for reading");
+                       }
+                       fetch->opcode -= 3; /* FETCH_W -> FETCH_R */
                }
                /* prevent double SWITCH_FREE */
                zend_stack_top(&CG(foreach_copy_stack), (void **) &foreach_copy);