Skip to content

Commit 07fc076

Browse files
committed
Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3: Fix constant evaluation of && and ||
2 parents 8753975 + 249e490 commit 07fc076

File tree

2 files changed

+24
-12
lines changed

2 files changed

+24
-12
lines changed

Zend/tests/const_eval_and.phpt

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
--TEST--
2+
Incorrect constant evaluation of and/or (OSS-Fuzz #19255)
3+
--FILE--
4+
<?php
5+
const C = 0 && __namespace__;
6+
var_dump(C);
7+
?>
8+
--EXPECT--
9+
bool(false)

Zend/zend_compile.c

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -8778,25 +8778,28 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */
87788778
case ZEND_AST_AND:
87798779
case ZEND_AST_OR:
87808780
{
8781-
int i;
8782-
for (i = 0; i <= 1; i++) {
8783-
zend_eval_const_expr(&ast->child[i]);
8784-
if (ast->child[i]->kind == ZEND_AST_ZVAL) {
8785-
if (zend_is_true(zend_ast_get_zval(ast->child[i])) == (ast->kind == ZEND_AST_OR)) {
8786-
ZVAL_BOOL(&result, ast->kind == ZEND_AST_OR);
8787-
return;
8788-
}
8789-
}
8781+
zend_bool child0_is_true, child1_is_true;
8782+
zend_eval_const_expr(&ast->child[0]);
8783+
zend_eval_const_expr(&ast->child[1]);
8784+
if (ast->child[0]->kind != ZEND_AST_ZVAL) {
8785+
return;
87908786
}
87918787

8792-
if (ast->child[0]->kind != ZEND_AST_ZVAL || ast->child[1]->kind != ZEND_AST_ZVAL) {
8788+
child0_is_true = zend_is_true(zend_ast_get_zval(ast->child[0]));
8789+
if (child0_is_true == (ast->kind == ZEND_AST_OR)) {
8790+
ZVAL_BOOL(&result, ast->kind == ZEND_AST_OR);
8791+
break;
8792+
}
8793+
8794+
if (ast->child[1]->kind != ZEND_AST_ZVAL) {
87938795
return;
87948796
}
87958797

8798+
child1_is_true = zend_is_true(zend_ast_get_zval(ast->child[1]));
87968799
if (ast->kind == ZEND_AST_OR) {
8797-
ZVAL_BOOL(&result, zend_is_true(zend_ast_get_zval(ast->child[0])) || zend_is_true(zend_ast_get_zval(ast->child[1])));
8800+
ZVAL_BOOL(&result, child0_is_true || child1_is_true);
87988801
} else {
8799-
ZVAL_BOOL(&result, zend_is_true(zend_ast_get_zval(ast->child[0])) && zend_is_true(zend_ast_get_zval(ast->child[1])));
8802+
ZVAL_BOOL(&result, child0_is_true && child1_is_true);
88008803
}
88018804
break;
88028805
}

0 commit comments

Comments
 (0)