From: Dmitry Stogov <dmitry@zend.com>
Date: Fri, 13 Sep 2019 09:08:59 +0000 (+0300)
Subject: Fixed incorrect usage of QM_ASSIGN instruction
X-Git-Tag: php-7.4.0RC2~36
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e45a757bc236a2cc59d84ea3a635d9373cf4c2da;p=php

Fixed incorrect usage of QM_ASSIGN instruction
---

diff --git a/NEWS b/NEWS
index ae8780f26b..63ee02113e 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,9 @@ PHP                                                                        NEWS
 ?? ??? ????, PHP 7.4.0RC2
 
 - Core:
+  . Fixed incorrect usage of QM_ASSIGN instruction. It must not return IS_VAR.
+    As a side effect this allowed passign left hean list() "by reference",
+    instead of compile-time error. (Dmitry)
   . Fixed bug #78531 (Crash when using undefined variable as object). (Dmitry)
 
 - FFI:
diff --git a/Zend/tests/bug73663.phpt b/Zend/tests/bug73663.phpt
index 0c6373bc95..06dd7f6700 100644
--- a/Zend/tests/bug73663.phpt
+++ b/Zend/tests/bug73663.phpt
@@ -20,12 +20,8 @@ var_dump($array);
 $array = [1];
 $func(list(&$val) = $array);
 var_dump($array);
-
-$array = [1];
-change(list($val) = $array);
-var_dump($array);
 ?>
---EXPECTF--
+--EXPECT--
 array(1) {
   [0]=>
   int(1)
@@ -74,9 +70,3 @@ array(10) {
   [9]=>
   int(10)
 }
-
-Notice: Only variables should be passed by reference in %s on line %d
-array(1) {
-  [0]=>
-  int(1)
-}
diff --git a/Zend/tests/bug73663_2.phpt b/Zend/tests/bug73663_2.phpt
new file mode 100644
index 0000000000..660a4f845e
--- /dev/null
+++ b/Zend/tests/bug73663_2.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #73663.2 ("Invalid opcode 65/16/8" occurs with a variable created with list())
+--FILE--
+<?php
+function change(&$ref) {
+	$ref = range(1, 10);
+	return;
+}
+
+$array = [1];
+change(list($val) = $array);
+var_dump($array);
+?>
+--EXPECTF--
+Fatal error: Only variables can be passed by reference in %s on line %d
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index e46c5b0d10..3fc35bedfd 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -2761,7 +2761,7 @@ void zend_compile_assign(znode *result, zend_ast *ast) /* {{{ */
 				if (zend_try_compile_cv(&cv_node, expr_ast) == FAILURE) {
 					zend_compile_simple_var_no_cv(&expr_node, expr_ast, BP_VAR_R, 0);
 				} else {
-					zend_emit_op(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
+					zend_emit_op_tmp(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
 				}
 			} else {
 				zend_compile_expr(&expr_node, expr_ast);
@@ -2801,7 +2801,7 @@ void zend_compile_assign(znode *result, zend_ast *ast) /* {{{ */
 					if (zend_try_compile_cv(&cv_node, expr_ast) == FAILURE) {
 						zend_compile_simple_var_no_cv(&expr_node, expr_ast, BP_VAR_R, 0);
 					} else {
-						zend_emit_op(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
+						zend_emit_op_tmp(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
 					}
 				} else {
 					zend_compile_expr(&expr_node, expr_ast);