From: Antony Dovgal <tony2001@php.net>
Date: Sat, 7 Jun 2008 12:46:54 +0000 (+0000)
Subject: disallow $a[] = value syntax
X-Git-Tag: BEFORE_HEAD_NS_CHANGE~1580
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=67630e0cd784a9a988239a2c9b6cc717491aae64;p=php

disallow $a[] = value syntax
---

diff --git a/ext/spl/spl_fastarray.c b/ext/spl/spl_fastarray.c
index ae1129c1ec..6449f0ddc2 100644
--- a/ext/spl/spl_fastarray.c
+++ b/ext/spl/spl_fastarray.c
@@ -321,6 +321,12 @@ static inline void spl_fastarray_object_write_dimension_helper(spl_fastarray_obj
 {
 	long index;
 
+	if (!offset) {
+		/* '$array[] = value' syntax is not supported */
+		zend_throw_exception(spl_ce_RuntimeException, "Index invalid or out of range", 0 TSRMLS_CC);
+		return;
+	}
+
 	index = spl_offset_convert_to_long(offset TSRMLS_CC);
 
 	if (index < 0 || index >= intern->array->size) {