Fix bug #2817 - assignments to string offsets could erronously modify unrelated strings

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 12dee1958674a639590ac9d1aca82e391f7e581c..839495497586730728ddde0d4caa414b710e5343 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -688,6 +688,8 @@ static inline void zend_fetch_dimension_address(znode *result, znode *op1, znode
                                                convert_to_long(&tmp);
                                                offset = &tmp;
                                        }
+                                       SEPARATE_ZVAL(container_ptr);
+                                       container = *container_ptr;
                                        Ts[result->u.var].EA.str = container;
                                        PZVAL_LOCK(container);
                                        Ts[result->u.var].EA.offset = offset->value.lval;