From: Nikita Popov <nikita.ppv@gmail.com>
Date: Wed, 4 Dec 2019 10:07:22 +0000 (+0100)
Subject: Fix incorrect assertion in property type variance check
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a6832caac9678fce098064a62137bb88e1d7e236;p=php

Fix incorrect assertion in property type variance check

Only one of the status has to be UNRESOLVED, the other could also
be SUCCESS.

Fixes oss-fuzz #19108 and oss-fuzz #19111.
---

diff --git a/Zend/tests/type_declarations/union_types/variance/invalid_004.phpt b/Zend/tests/type_declarations/union_types/variance/invalid_004.phpt
new file mode 100644
index 0000000000..db16fecbac
--- /dev/null
+++ b/Zend/tests/type_declarations/union_types/variance/invalid_004.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Invalid property inheritance where one direction is valid and the other unresolved
+--FILE--
+<?php
+class A {
+    public X|B $prop;
+}
+class B extends A {
+    public B $prop;
+} 
+?>
+--EXPECTF--
+Fatal error: Type of B::$prop must be X|B (as in class A) in %s on line %d
diff --git a/Zend/zend_inheritance.c b/Zend/zend_inheritance.c
index 9b8a47f365..1a27bbdfb6 100644
--- a/Zend/zend_inheritance.c
+++ b/Zend/zend_inheritance.c
@@ -966,7 +966,7 @@ inheritance_status property_types_compatible(
 	if (status1 == INHERITANCE_ERROR || status2 == INHERITANCE_ERROR) {
 		return INHERITANCE_ERROR;
 	}
-	ZEND_ASSERT(status1 == INHERITANCE_UNRESOLVED && status2 == INHERITANCE_UNRESOLVED);
+	ZEND_ASSERT(status1 == INHERITANCE_UNRESOLVED || status2 == INHERITANCE_UNRESOLVED);
 	return INHERITANCE_UNRESOLVED;
 }