From: Dmitry Stogov <dmitry@php.net>
Date: Wed, 12 Jan 2005 09:17:45 +0000 (+0000)
Subject: Fixed bug #31098 (isset false positive)
X-Git-Tag: php-5.0.4RC1~353
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d273e9a1135727f960af2665178d8e6fca293986;p=php

Fixed bug #31098 (isset false positive)
---

diff --git a/Zend/tests/bug31098.phpt b/Zend/tests/bug31098.phpt
index 8b3c1fc5ea..8e6c0277f9 100644
--- a/Zend/tests/bug31098.phpt
+++ b/Zend/tests/bug31098.phpt
@@ -14,12 +14,44 @@ $a = 'a';
 var_dump(isset($a{'b'}));
 $a = '0';
 var_dump(isset($a{'b'}));
+
+$simpleString = "Bogus String Text";
+echo isset($simpleString->wrong)?"bug\n":"ok\n";
+echo isset($simpleString["wrong"])?"bug\n":"ok\n";
+echo isset($simpleString[-1])?"bug\n":"ok\n";
+echo isset($simpleString[0])?"ok\n":"bug\n";
+echo isset($simpleString["0"])?"ok\n":"bug\n";
+echo isset($simpleString["16"])?"ok\n":"bug\n";
+echo isset($simpleString["17"])?"bug\n":"ok\n";
+echo isset($simpleString["wrong"][0])?"bug\n":"ok\n";
+echo $simpleString->wrong === null?"ok\n":"bug\n";
+echo $simpleString["wrong"] === null?"ok\n":"bug\n";
+echo $simpleString["0"] === "B"?"ok\n":"bug\n";
+$simpleString["wrong"] = "f";
+echo $simpleString["0"] === "B"?"ok\n":"bug\n";
 ?>
 --EXPECTF--
 bool(false)
 bool(false)
 bool(false)
 bool(false)
-bool(true)
-bool(true)
+bool(false)
+bool(false)
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+
+Notice: Trying to get property of non-object in %sbug31098.php on line %d
+ok
+
+Notice: Trying to get string index from a string in %sbug31098.php on line %d
+ok
+ok
 
+Notice: Trying to get string index from a string in %sbug31098.php on line %d
+ok
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index c23f27e880..b5b1d12a87 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -967,7 +967,24 @@ static void zend_fetch_dimension_address(znode *result, znode *op1, znode *op2,
 
 				offset = get_zval_ptr(op2, Ts, &EG(free_op2), BP_VAR_R);
 
-				if (offset->type != IS_LONG) {
+				if (Z_TYPE_P(offset) == IS_STRING) {
+					char *strval;
+					long  lval;
+
+					strval = Z_STRVAL_P(offset);
+					if (is_numeric_string(strval, Z_STRLEN_P(offset), &lval, NULL, 0) == IS_LONG) {
+					  ZVAL_LONG(&tmp, lval);
+						offset = &tmp;
+					} else {
+						if (type != BP_VAR_IS && type != BP_VAR_UNSET) {
+							zend_error(E_NOTICE, "Trying to get string index from a string");
+						}
+						*retval = &EG(error_zval_ptr);;
+						SELECTIVE_PZVAL_LOCK(**retval, result);
+						FREE_OP(Ts, op2, EG(free_op2));
+						return;
+					}
+				} else if (offset->type != IS_LONG) {
 					tmp = *offset;
 					zval_copy_ctor(&tmp);
 					convert_to_long(&tmp);
@@ -4032,32 +4049,39 @@ static int zend_isset_isempty_dim_prop_obj_handler(int prop_dim, ZEND_OPCODE_HAN
 			} else {
 				result = Z_OBJ_HT_P(*container)->has_dimension(*container, offset, (opline->extended_value == ZEND_ISEMPTY) TSRMLS_CC);
 			}
-		} else if ((*container)->type == IS_STRING) { /* string offsets */
-			zval tmp_offset;
-
-			if (!prop_dim) {
-				if (Z_TYPE_P(offset) != IS_LONG) {
-					tmp_offset = *offset;
-					zval_copy_ctor(&tmp_offset);
-					convert_to_long(&tmp_offset);
-					offset = &tmp_offset;
-				}
-				switch (opline->extended_value) {
-					case ZEND_ISSET:
-						if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) {
-							result = 1;
-						}
-						break;
-					case ZEND_ISEMPTY:
-						if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container) && Z_STRVAL_PP(container)[offset->value.lval] != '0') {
-							result = 1;
-						}
-						break;
+		} else if ((*container)->type == IS_STRING && !prop_dim) { /* string offsets */
+			zval tmp;
+
+			if (Z_TYPE_P(offset) == IS_STRING) {
+				char *strval;
+				long  lval;
+
+				strval = Z_STRVAL_P(offset);
+				if (is_numeric_string(strval, Z_STRLEN_P(offset), &lval, NULL, 0) == IS_LONG) {
+					ZVAL_LONG(&tmp, lval);
+					offset = &tmp;
 				}
+			} else if (offset->type != IS_LONG) {
+				tmp = *offset;
+				zval_copy_ctor(&tmp);
+				convert_to_long(&tmp);
+				offset = &tmp;
+			}
+			switch (opline->extended_value) {
+				case ZEND_ISSET:
+					if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) {
+						result = 1;
+					}
+					break;
+				case ZEND_ISEMPTY:
+					if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container) && Z_STRVAL_PP(container)[offset->value.lval] != '0') {
+						result = 1;
+					}
+					break;
 			}
 		}
 	}
-	
+
 	EX_T(opline->result.u.var).tmp_var.type = IS_BOOL;
 
 	switch (opline->extended_value) {