From: Moriyoshi Koizumi <moriyoshi@php.net>
Date: Wed, 3 Dec 2003 19:10:38 +0000 (+0000)
Subject: Fix bug #24773 (unset()ing string offsets crashes PHP)
X-Git-Tag: php-5.0.0b3RC1~376
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=7ac854e710feadd52f0c0e19c6f3515eaeb463a8;p=php

Fix bug #24773 (unset()ing string offsets crashes PHP)
---

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 4671d889d4..05063cbfe5 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1946,11 +1946,15 @@ int zend_fetch_dim_unset_handler(ZEND_OPCODE_HANDLER_ARGS)
 	}
 	*/
 	zend_fetch_dimension_address(&EX(opline)->result, &EX(opline)->op1, &EX(opline)->op2, EX(Ts), BP_VAR_R TSRMLS_CC);
-	PZVAL_UNLOCK(*EX_T(EX(opline)->result.u.var).var.ptr_ptr);
-	if (EX_T(EX(opline)->result.u.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
-		SEPARATE_ZVAL_IF_NOT_REF(EX_T(EX(opline)->result.u.var).var.ptr_ptr);
+	if (EX_T(EX(opline)->result.u.var).EA.type == IS_STRING_OFFSET) {
+		zend_error(E_WARNING, "Cannot unset string offsets");
+	} else {
+		PZVAL_UNLOCK(*EX_T(EX(opline)->result.u.var).var.ptr_ptr);
+		if (EX_T(EX(opline)->result.u.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) {
+			SEPARATE_ZVAL_IF_NOT_REF(EX_T(EX(opline)->result.u.var).var.ptr_ptr);
+		}
+		PZVAL_LOCK(*EX_T(EX(opline)->result.u.var).var.ptr_ptr);
 	}
-	PZVAL_LOCK(*EX_T(EX(opline)->result.u.var).var.ptr_ptr);
 	NEXT_OPCODE();
 }