From: Dmitry Stogov <dmitry@php.net>
Date: Wed, 16 Mar 2011 11:14:33 +0000 (+0000)
Subject: Fixed bug #54262 (Crash when assigning value to a dimension in a non-array)
X-Git-Tag: php-5.4.0alpha1~191^2~156
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=8c06867e11aecf3d47ac1fe8255d7abafbb9f706;p=php

Fixed bug #54262 (Crash when assigning value to a dimension in a non-array)
---

diff --git a/Zend/tests/bug54262.phpt b/Zend/tests/bug54262.phpt
new file mode 100644
index 0000000000..24c7122fcd
--- /dev/null
+++ b/Zend/tests/bug54262.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #54262 (Crash when assigning value to a dimension in a non-array)
+--FILE--
+<?php
+$a = '0';
+var_dump(isset($a['b']));
+$simpleString = preg_match('//', '', $a->a);
+$simpleString["wrong"] = "f";
+echo "ok\n";
+?>
+--EXPECTF--
+bool(true)
+
+Warning: Attempt to modify property of non-object in %s/Zend/tests/bug54262.php on line 4
+
+Warning: Cannot use a scalar value as an array in %s/Zend/tests/bug54262.php on line 5
+ok
\ No newline at end of file
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 79cff3e9ef..8de53845a5 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3051,10 +3051,10 @@ ZEND_VM_HANDLER(67, ZEND_SEND_REF, VAR|CV, ANY)
 	}
 
 	if (OP1_TYPE == IS_VAR && UNEXPECTED(*varptr_ptr == &EG(error_zval))) {
-		Z_DELREF_PP(varptr_ptr);
-		ALLOC_ZVAL(*varptr_ptr);
-		INIT_ZVAL(**varptr_ptr);
-		Z_SET_REFCOUNT_PP(varptr_ptr, 0);
+		ALLOC_INIT_ZVAL(varptr);
+		zend_vm_stack_push(varptr TSRMLS_CC);
+		CHECK_EXCEPTION();
+		ZEND_VM_NEXT_OPCODE();
 	}
 
 	if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION && !ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->op2.opline_num)) {
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index ad210ab7d9..ea83b6f441 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -10621,10 +10621,10 @@ static int ZEND_FASTCALL  ZEND_SEND_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARG
 	}
 
 	if (IS_VAR == IS_VAR && UNEXPECTED(*varptr_ptr == &EG(error_zval))) {
-		Z_DELREF_PP(varptr_ptr);
-		ALLOC_ZVAL(*varptr_ptr);
-		INIT_ZVAL(**varptr_ptr);
-		Z_SET_REFCOUNT_PP(varptr_ptr, 0);
+		ALLOC_INIT_ZVAL(varptr);
+		zend_vm_stack_push(varptr TSRMLS_CC);
+		CHECK_EXCEPTION();
+		ZEND_VM_NEXT_OPCODE();
 	}
 
 	if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION && !ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->op2.opline_num)) {
@@ -26310,10 +26310,10 @@ static int ZEND_FASTCALL  ZEND_SEND_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS
 	}
 
 	if (IS_CV == IS_VAR && UNEXPECTED(*varptr_ptr == &EG(error_zval))) {
-		Z_DELREF_PP(varptr_ptr);
-		ALLOC_ZVAL(*varptr_ptr);
-		INIT_ZVAL(**varptr_ptr);
-		Z_SET_REFCOUNT_PP(varptr_ptr, 0);
+		ALLOC_INIT_ZVAL(varptr);
+		zend_vm_stack_push(varptr TSRMLS_CC);
+		CHECK_EXCEPTION();
+		ZEND_VM_NEXT_OPCODE();
 	}
 
 	if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION && !ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->op2.opline_num)) {