From ca43e24f558c2fb237020f0cb2b74c7b24ffe775 Mon Sep 17 00:00:00 2001
From: Antony Dovgal <tony2001@php.net>
Date: Fri, 11 May 2007 09:38:52 +0000
Subject: [PATCH] fix #41351 (Invalid opcode with foreach ($a[] as $b))

---
 Zend/tests/bug41351.phpt   | 14 ++++++++++++++
 Zend/tests/bug41351_2.phpt | 14 ++++++++++++++
 Zend/tests/bug41351_3.phpt | 14 ++++++++++++++
 Zend/zend_compile.c        |  6 +++++-
 4 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 Zend/tests/bug41351.phpt
 create mode 100644 Zend/tests/bug41351_2.phpt
 create mode 100644 Zend/tests/bug41351_3.phpt

diff --git a/Zend/tests/bug41351.phpt b/Zend/tests/bug41351.phpt
new file mode 100644
index 0000000000..62af6a0336
--- /dev/null
+++ b/Zend/tests/bug41351.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #41351 (Invalid opcode with foreach ($a[] as $b))
+--FILE--
+<?php
+
+$a = array();
+
+foreach($a[] as $b) {
+}
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Fatal error: Cannot use [] for reading in %s on line %d
diff --git a/Zend/tests/bug41351_2.phpt b/Zend/tests/bug41351_2.phpt
new file mode 100644
index 0000000000..7009eaa457
--- /dev/null
+++ b/Zend/tests/bug41351_2.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #41351 (Invalid opcode with foreach ($a[] as $b)) - 2
+--FILE--
+<?php
+
+$a = array();
+
+foreach($a[]['test'] as $b) {
+}
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Fatal error: Cannot use [] for reading in %s on line %d
diff --git a/Zend/tests/bug41351_3.phpt b/Zend/tests/bug41351_3.phpt
new file mode 100644
index 0000000000..9cb23882c2
--- /dev/null
+++ b/Zend/tests/bug41351_3.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #41351 (Invalid opcode with foreach ($a[] as $b)) - 3
+--FILE--
+<?php
+
+$a = array();
+
+foreach($a['test'][] as $b) {
+}
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Fatal error: Cannot use [] for reading in %s on line %d
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index ff045941d5..18644d1076 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -4034,7 +4034,11 @@ void zend_do_foreach_cont(znode *foreach_token, znode *open_brackets_token, znod
 		/* Change "write context" into "read context" */
 		fetch->extended_value = 0;  /* reset ZEND_FE_RESET_VARIABLE */
 		while (fetch != end) {
-			(--fetch)->opcode -= 3; /* FETCH_W -> FETCH_R */
+			--fetch;
+			if (fetch->opcode == ZEND_FETCH_DIM_W && fetch->op2.op_type == IS_UNUSED) {
+				zend_error(E_COMPILE_ERROR, "Cannot use [] for reading");
+			}
+			fetch->opcode -= 3; /* FETCH_W -> FETCH_R */
 		}
 		/* prevent double SWITCH_FREE */
 		zend_stack_top(&CG(foreach_copy_stack), (void **) &foreach_copy);
-- 
2.40.0