diff options
| author | Xinchen Hui <laruence@gmail.com> | 2015-11-13 21:01:11 +0800 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2015-11-17 13:14:30 +0100 |
| commit | 815e456a7ada4865d1dfb3fbc90bfece4a02ba9e (patch) | |
| tree | fca38d0d715e4c939e2c116653732eb87e70f318 | |
| parent | 04d99b34339844c89d0e9eace7dd8793e3a1c6b6 (diff) | |
| download | php-git-815e456a7ada4865d1dfb3fbc90bfece4a02ba9e.tar.gz | |
Fixed bug #70912 (Null ptr dereference instantiating class with invalid array property)
| -rw-r--r-- | Zend/tests/bug70912.phpt | 10 | ||||
| -rw-r--r-- | Zend/zend_compile.c | 7 |
2 files changed, 15 insertions, 2 deletions
diff --git a/Zend/tests/bug70912.phpt b/Zend/tests/bug70912.phpt new file mode 100644 index 0000000000..3d6d4303a6 --- /dev/null +++ b/Zend/tests/bug70912.phpt @@ -0,0 +1,10 @@ +--TEST-- +Bug #70912 (Null ptr dereference when class property is initialised to a dereferenced value) +--FILE-- +<?php +class A { + public $a=[][]; +} +?> +--EXPECTF-- +Fatal error: Cannot use [] for reading in %sbug70912.php on line %d diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index c3e9384556..bc6b83c1b9 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -7381,12 +7381,15 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */ case ZEND_AST_DIM: { /* constant expression should be always read context ... */ - zval *container, *dim; + if (ast->child[1] == NULL) { + zend_error_noreturn(E_COMPILE_ERROR, "Cannot use [] for reading"); + } + zend_eval_const_expr(&ast->child[0]); zend_eval_const_expr(&ast->child[1]); - if (!ast->child[0] || !ast->child[1] || ast->child[0]->kind != ZEND_AST_ZVAL || ast->child[1]->kind != ZEND_AST_ZVAL) { + if (ast->child[0]->kind != ZEND_AST_ZVAL || ast->child[1]->kind != ZEND_AST_ZVAL) { return; } |