Add tests for oss-fuzz-61469: Undef dynamic property in ++/-- unset i…

…n error handler This was fixed as a consequence of a3a3964 Closes GH-12011
php · Sep 2, 2023 · 013bb57 · 013bb57
1 parent 508e70a
commit 013bb57
Show file tree

Hide file tree

Showing 5 changed files with 86 additions and 0 deletions.
diff --git a/Zend/tests/in-de-crement/oss-fuzz-61469_binop_dynamic_property_unset_error_handler.phpt b/Zend/tests/in-de-crement/oss-fuzz-61469_binop_dynamic_property_unset_error_handler.phpt
@@ -0,0 +1,16 @@
+--TEST--
+OSS Fuzz #61469: Undef variable in ++/-- for dynamic property that is unset in error handler
+--FILE--
+<?php
+class C {
+    function errorHandle() {
+        unset($this->a);
+    }
+}
+$c = new C;
+set_error_handler([$c,'errorHandle']);
+$c->a += 5;
+var_dump($c->a);
+?>
+--EXPECT--
+int(5)
diff --git a/Zend/tests/in-de-crement/oss-fuzz-61469_postdec_dynamic_property_unset_error_handler.phpt b/Zend/tests/in-de-crement/oss-fuzz-61469_postdec_dynamic_property_unset_error_handler.phpt
@@ -0,0 +1,19 @@
+--TEST--
+OSS Fuzz #61469: Undef variable in ++/-- for dynamic property that is unset in error handler
+--FILE--
+<?php
+class C {
+    function errorHandle() {
+        unset($this->a);
+    }
+}
+$c = new C;
+set_error_handler([$c,'errorHandle']);
+
+$v = ($c->a--);
+var_dump($c->a);
+var_dump($v);
+?>
+--EXPECT--
+NULL
+NULL
diff --git a/Zend/tests/in-de-crement/oss-fuzz-61469_postinc_dynamic_property_unset_error_handler.phpt b/Zend/tests/in-de-crement/oss-fuzz-61469_postinc_dynamic_property_unset_error_handler.phpt
@@ -0,0 +1,19 @@
+--TEST--
+OSS Fuzz #61469: Undef variable in ++/-- for dynamic property that is unset in error handler
+--FILE--
+<?php
+class C {
+    function errorHandle() {
+        unset($this->a);
+    }
+}
+$c = new C;
+set_error_handler([$c,'errorHandle']);
+
+$v = ($c->a--);
+var_dump($c->a);
+var_dump($v);
+?>
+--EXPECT--
+NULL
+NULL
diff --git a/Zend/tests/in-de-crement/oss-fuzz-61469_predec_dynamic_property_unset_error_handler.phpt b/Zend/tests/in-de-crement/oss-fuzz-61469_predec_dynamic_property_unset_error_handler.phpt
@@ -0,0 +1,16 @@
+--TEST--
+OSS Fuzz #61469: Undef variable in ++/-- for dynamic property that is unset in error handler
+--FILE--
+<?php
+class C {
+    function errorHandle() {
+        unset($this->a);
+    }
+}
+$c = new C;
+set_error_handler([$c,'errorHandle']);
+(--$c->a);
+var_dump($c->a);
+?>
+--EXPECT--
+NULL
diff --git a/Zend/tests/in-de-crement/oss-fuzz-61469_preinc_dynamic_property_unset_error_handler.phpt b/Zend/tests/in-de-crement/oss-fuzz-61469_preinc_dynamic_property_unset_error_handler.phpt
@@ -0,0 +1,16 @@
+--TEST--
+OSS Fuzz #61469: Undef variable in ++/-- for dynamic property that is unset in error handler
+--FILE--
+<?php
+class C {
+    function errorHandle() {
+        unset($this->a);
+    }
+}
+$c = new C;
+set_error_handler([$c,'errorHandle']);
+(++$c->a);
+var_dump($c->a);
+?>
+--EXPECT--
+int(1)