- Fixed bug #47903 ("@" operator does not work with string offsets (PHP_5_2 only!))

  (MFH: #39018)

diff --git a/NEWS b/NEWS
index b24a0e2404a9c038431c32fd8051c86a250a26e1..d444439a925f900854c851181c34f95f40f6ee9a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,7 @@ PHP                                                                        NEWS
 - Fixed memory leak in ob_get_clean/ob_get_flush. (Christian)
 - Fixed segfault on invalid session.save_path. (Hannes)
 
+- Fixed bug #47903 ("@" operator does not work with string offsets). (Felipe)
 - Fixed bug #47845 (PDO_Firebird omits first row from query). (Lars W)
 - Fixed bug #47831 (Compile warning for strnlen() in main/spprintf.c).
   (Ilia, rainer dot jung at kippdata dot de)

diff --git a/Zend/tests/bug39304.phpt b/Zend/tests/bug39304.phpt
index 9e4416c9698261c1d2355bdc7f5bea870861e40d..5ab569ba6e09748325b5a626ea55b1ac4fa94e61 100755 (executable)
--- a/Zend/tests/bug39304.phpt
+++ b/Zend/tests/bug39304.phpt
@@ -6,4 +6,6 @@ Bug #39304 (Segmentation fault with list unpacking of string offset)
   list($a, $b) = $s[0];
 ?>
 --EXPECTF--
-Fatal error: Cannot use string offset as an array in %sbug39304.php on line 3
+Notice: Uninitialized string offset: 0 in %s on line %d
+
+Fatal error: Cannot use string offset as an array in %sbug39304.php on line %d

diff --git a/Zend/tests/bug41919.phpt b/Zend/tests/bug41919.phpt
index 0ac3276b076d9052d368258929113c1b8389b3ca..2c4f985ebb0ec282ef02a36ec277a0fc18a9bba7 100644 (file)
--- a/Zend/tests/bug41919.phpt
+++ b/Zend/tests/bug41919.phpt
@@ -8,4 +8,6 @@ $foo[3]->bar[1] = "bang";
 echo "ok\n";
 ?>
 --EXPECTF--
+Notice: Uninitialized string offset: 3 in %s on line %d
+
 Fatal error: Cannot use string offset as an object in %sbug41919.php on line %d

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 3dc4ab225370d80229779b8f6f7a19331973474a..6fe169784c76747f2bb3c4ee371fabc7698c4a6c 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -183,7 +183,6 @@ static inline zval *_get_zval_ptr_var(znode *node, temp_variable *Ts, zend_free_
                if (T->str_offset.str->type != IS_STRING
                        || ((int)T->str_offset.offset < 0)
                        || (T->str_offset.str->value.str.len <= (int)T->str_offset.offset)) {
-                       zend_error(E_NOTICE, "Uninitialized string offset:  %d", T->str_offset.offset);
                        ptr->value.str.val = STR_EMPTY_ALLOC();
                        ptr->value.str.len = 0;
                } else {
@@ -1133,6 +1132,9 @@ static void zend_fetch_dimension_address(temp_variable *result, zval **container
                                                break;
                                }
                                if (result) {
+                                       if (Z_LVAL_P(dim) < 0 || Z_STRLEN_P(container) <= Z_LVAL_P(dim)) {
+                                               zend_error(E_NOTICE, "Uninitialized string offset: %ld", Z_LVAL_P(dim));
+                                       }
                                        container = *container_ptr;
                                        result->str_offset.str = container;
                                        PZVAL_LOCK(container);