Skip to content

Commit d1b1866

Browse files
laruencelaruence
committed
Fixed bug #76534 (PHP hangs on 'illegal string offset on string references with an error handler)
1 parent 6b5597f commit d1b1866

File tree

5 files changed

+49
-10
lines changed

5 files changed

+49
-10
lines changed

‎NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ PHP NEWS
33
?? ??? ????, PHP 7.1.20
44

55
- Core:
6+
. Fixed bug #76534 (PHP hangs on 'illegal string offset on string references
7+
with an error handler). (Laruence)
68
. Fixed bug #76502 (Chain of mixed exceptions and errors does not serialize
79
properly). (Nikita)
810

‎Zend/tests/bug76534.phpt

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
--TEST--
2+
Bug #76534 (PHP hangs on 'illegal string offset on string references with an error handler)
3+
--FILE--
4+
<?php
5+
set_error_handler(function ($severity, $message, $file, $line) {
6+
throw new \Exception($message);
7+
});
8+
9+
$x = "foo";
10+
$y = &$x["bar"];
11+
?>
12+
--EXPECTF--
13+
Fatal error: Uncaught Exception: Illegal string offset 'bar' in %sbug76534.php:%d
14+
Stack trace:
15+
#0 %sbug76534.php(%d): {closure}(2, 'Illegal string ...', '%s', %d, Array)
16+
#1 {main}
17+
thrown in %sbug76534.php on line %d

‎Zend/zend_execute.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1700,7 +1700,9 @@ static zend_always_inline void zend_fetch_dimension_address(zval *result, zval *
17001700
zend_throw_error(NULL, "[] operator not supported for strings");
17011701
} else {
17021702
zend_check_string_offset(dim, type);
1703-
zend_wrong_string_offset();
1703+
if (EXPECTED(EG(exception) == NULL)) {
1704+
zend_wrong_string_offset();
1705+
}
17041706
}
17051707
ZVAL_ERROR(result);
17061708
} else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {

‎Zend/zend_vm_def.h

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -891,7 +891,9 @@ ZEND_VM_C_LABEL(assign_dim_op_convert_to_array):
891891
zend_throw_error(NULL, "[] operator not supported for strings");
892892
} else {
893893
zend_check_string_offset(dim, BP_VAR_RW);
894-
zend_wrong_string_offset();
894+
if (EXPECTED(EG(exception) == NULL)) {
895+
zend_wrong_string_offset();
896+
}
895897
}
896898
} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
897899
ZEND_VM_C_GOTO(assign_dim_op_convert_to_array);

‎Zend/zend_vm_execute.h

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17596,7 +17596,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_binary_assign_op_dim_helper_SP
1759617596
zend_throw_error(NULL, "[] operator not supported for strings");
1759717597
} else {
1759817598
zend_check_string_offset(dim, BP_VAR_RW);
17599-
zend_wrong_string_offset();
17599+
if (EXPECTED(EG(exception) == NULL)) {
17600+
zend_wrong_string_offset();
17601+
}
1760017602
}
1760117603
} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
1760217604
goto assign_dim_op_convert_to_array;
@@ -21014,7 +21016,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_binary_assign_op_dim_helper_SP
2101421016
zend_throw_error(NULL, "[] operator not supported for strings");
2101521017
} else {
2101621018
zend_check_string_offset(dim, BP_VAR_RW);
21017-
zend_wrong_string_offset();
21019+
if (EXPECTED(EG(exception) == NULL)) {
21020+
zend_wrong_string_offset();
21021+
}
2101821022
}
2101921023
} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
2102021024
goto assign_dim_op_convert_to_array;
@@ -22385,7 +22389,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_binary_assign_op_dim_helper_SP
2238522389
zend_throw_error(NULL, "[] operator not supported for strings");
2238622390
} else {
2238722391
zend_check_string_offset(dim, BP_VAR_RW);
22388-
zend_wrong_string_offset();
22392+
if (EXPECTED(EG(exception) == NULL)) {
22393+
zend_wrong_string_offset();
22394+
}
2238922395
}
2239022396
} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
2239122397
goto assign_dim_op_convert_to_array;
@@ -25330,7 +25336,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_binary_assign_op_dim_helper_SP
2533025336
zend_throw_error(NULL, "[] operator not supported for strings");
2533125337
} else {
2533225338
zend_check_string_offset(dim, BP_VAR_RW);
25333-
zend_wrong_string_offset();
25339+
if (EXPECTED(EG(exception) == NULL)) {
25340+
zend_wrong_string_offset();
25341+
}
2533425342
}
2533525343
} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
2533625344
goto assign_dim_op_convert_to_array;
@@ -37055,7 +37063,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_binary_assign_op_dim_helper_SP
3705537063
zend_throw_error(NULL, "[] operator not supported for strings");
3705637064
} else {
3705737065
zend_check_string_offset(dim, BP_VAR_RW);
37058-
zend_wrong_string_offset();
37066+
if (EXPECTED(EG(exception) == NULL)) {
37067+
zend_wrong_string_offset();
37068+
}
3705937069
}
3706037070
} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
3706137071
goto assign_dim_op_convert_to_array;
@@ -41665,7 +41675,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_binary_assign_op_dim_helper_SP
4166541675
zend_throw_error(NULL, "[] operator not supported for strings");
4166641676
} else {
4166741677
zend_check_string_offset(dim, BP_VAR_RW);
41668-
zend_wrong_string_offset();
41678+
if (EXPECTED(EG(exception) == NULL)) {
41679+
zend_wrong_string_offset();
41680+
}
4166941681
}
4167041682
} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
4167141683
goto assign_dim_op_convert_to_array;
@@ -44149,7 +44161,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_binary_assign_op_dim_helper_SP
4414944161
zend_throw_error(NULL, "[] operator not supported for strings");
4415044162
} else {
4415144163
zend_check_string_offset(dim, BP_VAR_RW);
44152-
zend_wrong_string_offset();
44164+
if (EXPECTED(EG(exception) == NULL)) {
44165+
zend_wrong_string_offset();
44166+
}
4415344167
}
4415444168
} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
4415544169
goto assign_dim_op_convert_to_array;
@@ -48220,7 +48234,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_binary_assign_op_dim_helper_SP
4822048234
zend_throw_error(NULL, "[] operator not supported for strings");
4822148235
} else {
4822248236
zend_check_string_offset(dim, BP_VAR_RW);
48223-
zend_wrong_string_offset();
48237+
if (EXPECTED(EG(exception) == NULL)) {
48238+
zend_wrong_string_offset();
48239+
}
4822448240
}
4822548241
} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
4822648242
goto assign_dim_op_convert_to_array;

0 commit comments

Comments
 (0)