diff options
| author | Xinchen Hui <laruence@gmail.com> | 2015-11-13 21:01:11 +0800 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2015-11-17 13:14:30 +0100 |
| commit | 815e456a7ada4865d1dfb3fbc90bfece4a02ba9e (patch) | |
| tree | fca38d0d715e4c939e2c116653732eb87e70f318 /Zend/zend_compile.c | |
| parent | 04d99b34339844c89d0e9eace7dd8793e3a1c6b6 (diff) | |
| download | php-git-815e456a7ada4865d1dfb3fbc90bfece4a02ba9e.tar.gz | |
Fixed bug #70912 (Null ptr dereference instantiating class with invalid array property)
Diffstat (limited to 'Zend/zend_compile.c')
| -rw-r--r-- | Zend/zend_compile.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index c3e9384556..bc6b83c1b9 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -7381,12 +7381,15 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */ case ZEND_AST_DIM: { /* constant expression should be always read context ... */ - zval *container, *dim; + if (ast->child[1] == NULL) { + zend_error_noreturn(E_COMPILE_ERROR, "Cannot use [] for reading"); + } + zend_eval_const_expr(&ast->child[0]); zend_eval_const_expr(&ast->child[1]); - if (!ast->child[0] || !ast->child[1] || ast->child[0]->kind != ZEND_AST_ZVAL || ast->child[1]->kind != ZEND_AST_ZVAL) { + if (ast->child[0]->kind != ZEND_AST_ZVAL || ast->child[1]->kind != ZEND_AST_ZVAL) { return; } |