php-src/Zend/tests/str_offset_007.phpt
Dmitry Stogov 09547c64c2 Fix clobering of operand by error handler in assignment to string offset
In some cases new code requires two reallocations insead of one.

Fixes oss-fuzz #31716, #36196, #39739 and #40002
2021-12-02 00:24:05 +03:00

17 lines
306 B
PHP

--TEST--
string offset 007 indirect string modification by error handler
--FILE--
<?php
set_error_handler(function($code, $msg) {
echo "Err: $msg\n";
$GLOBALS['a']='';
});
$a=['a'];
$a[0][$d]='b';
var_dump($a);
?>
--EXPECT--
Err: Undefined variable $d
Err: String offset cast occurred
string(0) ""