From 9183f91b506a858f5f53c13b63c485e859eeac0f Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@php.net>
Date: Wed, 10 Aug 2005 10:37:24 +0000
Subject: [PATCH] Fixed bug #34064 (arr[] as param to function is allowed only
 if function receives argument by reference)

---
 NEWS                     |  2 ++
 Zend/tests/bug34064.phpt | 35 +++++++++++++++++++++++++++++++++++
 Zend/zend_execute.c      |  3 +++
 3 files changed, 40 insertions(+)
 create mode 100755 Zend/tests/bug34064.phpt

diff --git a/NEWS b/NEWS
index abe02d498b..f4e387f5ea 100644
--- a/NEWS
+++ b/NEWS
@@ -19,6 +19,8 @@ PHP                                                                        NEWS
 - Fixed memory corruption in ImageTTFText() with 64bit systems. (Andrey)
 - Fixed memory corruption in stristr(). (Derick)
 - Fixed segfaults when CURL callback functions throw exception. (Tony)
+- Fixed bug #34064 (arr[] as param to function is allowed only if function 
+  receives argument by reference). (Dmitry)
 - Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP). (Dmitry)
 - Fixed bug #33940 (array_map() fails to pass by reference when called
   recursively). (Dmitry)
diff --git a/Zend/tests/bug34064.phpt b/Zend/tests/bug34064.phpt
new file mode 100755
index 0000000000..84208a54f8
--- /dev/null
+++ b/Zend/tests/bug34064.phpt
@@ -0,0 +1,35 @@
+--TEST--
+Bug #34064 (arr[] as param to function in class gives invalid opcode)
+--FILE--
+<?php
+class XmlTest {
+
+    function test_ref(&$test)
+    {
+    	$test = "ok";
+    }
+
+    function test($test)
+    {
+    }
+
+    function run()
+    {
+        $ar = array();
+        $this->test_ref($ar[]);
+        var_dump($ar);
+        $this->test($ar[]);
+    }
+}
+
+$o = new XmlTest();
+$o->run();
+?>
+--EXPECTF--
+array(1) {
+  [0]=>
+  string(2) "ok"
+}
+
+Fatal error: Cannot use [] for reading in %sbug34064.php on line 18
+
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index b000eb0a87..e87dd55df5 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -2131,6 +2131,9 @@ int zend_fetch_dim_func_arg_handler(ZEND_OPCODE_HANDLER_ARGS)
 		/* Behave like FETCH_DIM_W */
 		zend_fetch_dimension_address(&opline->result, &opline->op1, &opline->op2, EX(Ts), BP_VAR_W TSRMLS_CC);
 	} else {
+		if (opline->op2.op_type == IS_UNUSED) {
+			zend_error(E_ERROR, "Cannot use [] for reading");
+		}
 		/* Behave like FETCH_DIM_R, except for locking used for list() */
 		zend_fetch_dimension_address(&opline->result, &opline->op1, &opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC);
 		AI_USE_PTR(EX_T(opline->result.u.var).var);
-- 
2.40.0