Fixed bug #74623

php · Jun 23, 2017 · 5b5a92b · 5b5a92b
1 parent 4948da1
commit 5b5a92b
Show file tree

Hide file tree

Showing 3 changed files with 27 additions and 1 deletion.
diff --git a/NEWS b/NEWS
@@ -7,6 +7,10 @@ PHP                                                                        NEWS
     (jhdxr)
   . Fixed bug #74761 (Unary operator expected error on some systems). (petk)
 
+- Opcache:
+  . Fixed bug #74623 (Infinite loop in type inference when using HTMLPurifier).
+    (nikic)
+
 - SPL:
   . Fixed bug #73471 (PHP freezes with AppendIterator). (jhdxr)
 

diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
@@ -3109,7 +3109,7 @@ static int zend_update_type_info(const zend_op_array *op_array,
 				    opline->opcode == ZEND_FETCH_OBJ_RW ||
 				    opline->opcode == ZEND_FETCH_OBJ_FUNC_ARG) {
 					if (opline->opcode != ZEND_FETCH_DIM_FUNC_ARG) {
-						if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_NULL)) {
+						if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
 							tmp &= ~(MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE);
 							tmp |= MAY_BE_OBJECT | MAY_BE_RC1 | MAY_BE_RCN;
 						}

diff --git a/ext/opcache/tests/bug74623.phpt b/ext/opcache/tests/bug74623.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #74623: Infinite loop in type inference when using HTMLPurifier
+--FILE--
+<?php
+
+function crash($arr) {
+    $current_item = false;
+
+    foreach($arr as $item) {
+        if($item->name === 'string') {
+            $current_item = $item;
+        } else {
+            $current_item->a[] = '';
+        }
+    }
+
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===