Fixed type inference

Fixes oss-fuzz #64577, #64579, #64589
php · Dec 1, 2023 · 1e55c97 · 1e55c97
1 parent 9a69bb2
commit 1e55c97
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 1 deletion.
diff --git a/Zend/Optimizer/zend_inference.c b/Zend/Optimizer/zend_inference.c
@@ -3673,7 +3673,8 @@ static zend_always_inline zend_result _zend_update_type_info(
 						tmp &= ~MAY_BE_ARRAY_EMPTY;
 					}
 				}
-				if (((tmp & MAY_BE_ARRAY) && (tmp & MAY_BE_ARRAY_KEY_ANY))
+				if (!(tmp & MAY_BE_ARRAY)
+				 || (tmp & MAY_BE_ARRAY_KEY_ANY)
 				 || opline->opcode == ZEND_FETCH_DIM_FUNC_ARG
 				 || opline->opcode == ZEND_FETCH_DIM_R
 				 || opline->opcode == ZEND_FETCH_DIM_IS

diff --git a/ext/opcache/tests/opt/inference_024.phpt b/ext/opcache/tests/opt/inference_024.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Type inference 024: FETCH_DIM_W
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+--FILE--
+<?php
+function foo() {
+    for ($cnt = 0; $cnt < 6; $cnt++) {
+        $b = new SplFixedArray(1);
+        $b[0] = $a;
+        $g = &$b[0];
+        $b = new SplFixedArray(1);
+        $b[0] = $b;
+        $g = &$b[0];
+    }
+}
+@foo();
+?>
+DONE
+--EXPECT--
+DONE