From: Nikita Popov <nikita.ppv@gmail.com>
Date: Fri, 25 Oct 2019 08:27:45 +0000 (+0200)
Subject: Check type is set when verifying variadic args
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bd7b1afd6eb623a4905673dfc92bb0de62f23edd;p=php

Check type is set when verifying variadic args

Weird that there was no test for this...

This code is somewhat inefficient, because it will be performed
for every arg, rather than only once.
---

diff --git a/Zend/tests/bug67938.phpt b/Zend/tests/bug67938.phpt
index 6597c4895f..fc8a9ab517 100644
--- a/Zend/tests/bug67938.phpt
+++ b/Zend/tests/bug67938.phpt
@@ -20,8 +20,10 @@ class Test implements TestInterface {
 $obj = new Test;
 $obj->foo();
 $obj->bar([]);
+$obj->bar([], 1);
 
 ?>
 --EXPECT--
 Test::foo
 Test::bar
+Test::bar
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 7544742cd7..673840ace5 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1042,7 +1042,8 @@ static zend_always_inline int zend_verify_variadic_arg_type(zend_function *zf, u
 	ZEND_ASSERT(zf->common.fn_flags & ZEND_ACC_VARIADIC);
 	cur_arg_info = &zf->common.arg_info[zf->common.num_args];
 
-	if (UNEXPECTED(!zend_check_type(cur_arg_info->type, arg, cache_slot, zf->common.scope, 0, 0))) {
+	if (ZEND_TYPE_IS_SET(cur_arg_info->type)
+			&& UNEXPECTED(!zend_check_type(cur_arg_info->type, arg, cache_slot, zf->common.scope, 0, 0))) {
 		zend_verify_arg_error(zf, cur_arg_info, arg_num, cache_slot, arg);
 		return 0;
 	}