Fix bug #22592 - cascading assignments to string offsets

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 73a9ba6a3bd22ae05c1813b90a8d9fcaeee60085..29c57a90bf92d34a0b240409635d5caade01a53c 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -470,7 +470,16 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
                                                if (op2) {
                                                        if (op2->op_type == IS_VAR) {
                                                                if (value == &T(op2->u.var).tmp_var) {
-                                                                       STR_FREE(value->value.str.val);
+                                                                       if(result->u.EA.type & EXT_TYPE_UNUSED) {
+                                                                               /* We are not going to use return value, drop it */
+                                                                               STR_FREE(value->value.str.val);
+                                                                       } else {
+                                                                               /* We are going to use return value, make it real zval */
+                                                                               ALLOC_INIT_ZVAL(value);
+                                                                               *value = T(op2->u.var).tmp_var;
+                                                                               value->is_ref = 0;
+                                                                               value->refcount = 0; /* LOCK will increase it */
+                                                                       }
                                                                }
                                                        } else {
                                                                if (final_value == &T(op2->u.var).tmp_var) {
@@ -495,7 +504,8 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
                                break;
                        EMPTY_SWITCH_DEFAULT_CASE()
                }
-               T(result->u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr);
+/*             T(result->u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr); */
+               T(result->u.var).var.ptr_ptr = &value;
                SELECTIVE_PZVAL_LOCK(*T(result->u.var).var.ptr_ptr, result);
                AI_USE_PTR(T(result->u.var).var);
                return;