Skip to content

Commit faa143c

Browse files
dstogovdstogov
committed
Merge branch 'PHP-8.1'
* PHP-8.1: Fix array clobbering by user error handler
2 parents f583c4d + 75b2973 commit faa143c

File tree

3 files changed

+40
-6
lines changed

3 files changed

+40
-6
lines changed

‎Zend/tests/falsetoarray_003.phpt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
Autovivification of false to array with data clobbering by error handler
3+
--FILE--
4+
<?php
5+
set_error_handler(function($code, $msg) {
6+
echo "Err: $msg\n";
7+
$GLOBALS['a']=9;
8+
});
9+
$a=[];
10+
($a[PHP_INT_MAX+1]);
11+
?>
12+
DONE
13+
--EXPECTF--
14+
Err: Implicit conversion from float %f to int loses precision
15+
Err: Undefined array key %i
16+
DONE

‎Zend/zend_vm_def.h‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9710,7 +9710,10 @@ ZEND_VM_C_LABEL(fetch_dim_r_index_array):
97109710
if (EXPECTED(Z_TYPE_P(dim) == IS_LONG)) {
97119711
offset = Z_LVAL_P(dim);
97129712
} else {
9713-
offset = zval_get_long_ex(dim, /* is_strict */ true);
9713+
SAVE_OPLINE();
9714+
zend_fetch_dimension_address_read_R(container, dim, OP2_TYPE OPLINE_CC EXECUTE_DATA_CC);
9715+
FREE_OP1();
9716+
ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
97149717
}
97159718
ht = Z_ARRVAL_P(container);
97169719
ZEND_HASH_INDEX_FIND(ht, offset, value, ZEND_VM_C_LABEL(fetch_dim_r_index_undef));

‎Zend/zend_vm_execute.h‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8313,7 +8313,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_R_INDEX_
83138313
if (EXPECTED(Z_TYPE_P(dim) == IS_LONG)) {
83148314
offset = Z_LVAL_P(dim);
83158315
} else {
8316-
offset = zval_get_long_ex(dim, /* is_strict */ true);
8316+
SAVE_OPLINE();
8317+
zend_fetch_dimension_address_read_R(container, dim, (IS_TMP_VAR|IS_VAR|IS_CV) OPLINE_CC EXECUTE_DATA_CC);
8318+
8319+
ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
83178320
}
83188321
ht = Z_ARRVAL_P(container);
83198322
ZEND_HASH_INDEX_FIND(ht, offset, value, fetch_dim_r_index_undef);
@@ -16149,7 +16152,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_R_INDEX_
1614916152
if (EXPECTED(Z_TYPE_P(dim) == IS_LONG)) {
1615016153
offset = Z_LVAL_P(dim);
1615116154
} else {
16152-
offset = zval_get_long_ex(dim, /* is_strict */ true);
16155+
SAVE_OPLINE();
16156+
zend_fetch_dimension_address_read_R(container, dim, IS_CONST OPLINE_CC EXECUTE_DATA_CC);
16157+
zval_ptr_dtor_nogc(EX_VAR(opline->op1.var));
16158+
ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
1615316159
}
1615416160
ht = Z_ARRVAL_P(container);
1615516161
ZEND_HASH_INDEX_FIND(ht, offset, value, fetch_dim_r_index_undef);
@@ -16201,7 +16207,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_R_INDEX_
1620116207
if (EXPECTED(Z_TYPE_P(dim) == IS_LONG)) {
1620216208
offset = Z_LVAL_P(dim);
1620316209
} else {
16204-
offset = zval_get_long_ex(dim, /* is_strict */ true);
16210+
SAVE_OPLINE();
16211+
zend_fetch_dimension_address_read_R(container, dim, (IS_TMP_VAR|IS_VAR|IS_CV) OPLINE_CC EXECUTE_DATA_CC);
16212+
zval_ptr_dtor_nogc(EX_VAR(opline->op1.var));
16213+
ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
1620516214
}
1620616215
ht = Z_ARRVAL_P(container);
1620716216
ZEND_HASH_INDEX_FIND(ht, offset, value, fetch_dim_r_index_undef);
@@ -43065,7 +43074,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_R_INDEX_
4306543074
if (EXPECTED(Z_TYPE_P(dim) == IS_LONG)) {
4306643075
offset = Z_LVAL_P(dim);
4306743076
} else {
43068-
offset = zval_get_long_ex(dim, /* is_strict */ true);
43077+
SAVE_OPLINE();
43078+
zend_fetch_dimension_address_read_R(container, dim, IS_CONST OPLINE_CC EXECUTE_DATA_CC);
43079+
43080+
ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
4306943081
}
4307043082
ht = Z_ARRVAL_P(container);
4307143083
ZEND_HASH_INDEX_FIND(ht, offset, value, fetch_dim_r_index_undef);
@@ -43117,7 +43129,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_DIM_R_INDEX_
4311743129
if (EXPECTED(Z_TYPE_P(dim) == IS_LONG)) {
4311843130
offset = Z_LVAL_P(dim);
4311943131
} else {
43120-
offset = zval_get_long_ex(dim, /* is_strict */ true);
43132+
SAVE_OPLINE();
43133+
zend_fetch_dimension_address_read_R(container, dim, (IS_TMP_VAR|IS_VAR|IS_CV) OPLINE_CC EXECUTE_DATA_CC);
43134+
43135+
ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
4312143136
}
4312243137
ht = Z_ARRVAL_P(container);
4312343138
ZEND_HASH_INDEX_FIND(ht, offset, value, fetch_dim_r_index_undef);

0 commit comments

Comments
 (0)