mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-12-05 07:46:06 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix type inference

Browse Source 
This fixes oss-fuzz #47049
This commit is contained in:
Dmitry Stogov 2022-05-11 12:09:11 +03:00
parent 23a2030438
commit 3f1e1b9ddf
2 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ext/opcache/Optimizer/zend_inference.c
View File

@ -3219,10 +3219,11 @@ static zend_always_inline int _zend_update_type_info(
tmp |= t1 & (MAY_BE_RC1|MAY_BE_RCN);
}
}
if (opline->opcode == ZEND_FETCH_DIM_RW
if ((key_type & (MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING))
&& (opline->opcode == ZEND_FETCH_DIM_RW
|| opline->opcode == ZEND_FETCH_DIM_W
|| opline->opcode == ZEND_FETCH_DIM_FUNC_ARG
|| opline->opcode == ZEND_FETCH_LIST_W) {
|| opline->opcode == ZEND_FETCH_LIST_W)) {
j = ssa_vars[ssa_op->result_def].use_chain;
if (j < 0) {
/* no uses */

16
ext/opcache/tests/opt/inference_006.phpt Normal file
View File

@ -0,0 +1,16 @@
--TEST--
Type inference 006: FETCH_DIM_W with invalid key type
--INI--
opcache.enable=1
opcache.enable_cli=1
opcache.optimization_level=-1
--FILE--
<?php
function y() {
$obj=new y;
u($y[$obj]);
}
?>
DONE
--EXPECT--
DONE