Skip to content

Commit a07c1f5

Browse files
committed
Fix infinite loop on string offset during by-ref list assign
There is a deeper underlying issue here, in that the opcodes violate VM write-fetch safety, but let's fix the infinite loop first. This fixes oss-fuzz #25352.
1 parent cd2afd9 commit a07c1f5

File tree

2 files changed

+17
-0
lines changed

2 files changed

+17
-0
lines changed
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
String offset error during list() by-ref assignment
3+
--FILE--
4+
<?php
5+
6+
$a = [0];
7+
$v = 'b';
8+
$i = 0;
9+
list(&$a[$i++]) = $v;
10+
11+
?>
12+
--EXPECTF--
13+
Fatal error: Uncaught Error: Cannot create references to/from string offsets in %s:%d
14+
Stack trace:
15+
#0 {main}
16+
thrown in %s on line %d

Zend/zend_execute.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1329,6 +1329,7 @@ static zend_never_inline ZEND_COLD void zend_wrong_string_offset(EXECUTE_DATA_D)
13291329
msg = "Cannot create references to/from string offsets";
13301330
break;
13311331
}
1332+
opline++;
13321333
}
13331334
break;
13341335
EMPTY_SWITCH_DEFAULT_CASE();

0 commit comments

Comments
 (0)