From: Dmitry Stogov <dmitry@php.net>
Date: Mon, 9 Jul 2007 08:56:29 +0000 (+0000)
Subject: Fixed bug #41919
X-Git-Tag: BEFORE_IMPORT_OF_MYSQLND~302
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=2d393762198fabd572488ab2242cbead604fb1b0;p=php

Fixed bug #41919
---

diff --git a/Zend/tests/bug41919.phpt b/Zend/tests/bug41919.phpt
new file mode 100644
index 0000000000..3ba9ae0ec4
--- /dev/null
+++ b/Zend/tests/bug41919.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #41919 (crash in string to array conversion)
+--FILE--
+<?php
+$foo="50";
+$foo[3]->bar[1] = "bang";
+
+echo "ok\n";
+?>
+--EXPECTF--
+Fatal error: Cannot use string offset as an object in %s/bug41919.php on line %d
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index f632fe7d3b..8a761db62e 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1239,6 +1239,10 @@ static void zend_fetch_property_address(temp_variable *result, zval **container_
 {
 	zval *container;
 
+	if (!container_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	container = *container_ptr;
 	if (container == EG(error_zval_ptr)) {
 		if (result) {