Skip to content

Commit 2fde308

Browse files
committed
JIT: Fix ASSIGN_DIM_OP with undefined variable and index and user error handler, throwing an exception
Fixes oss-fuzz #39422
1 parent 94286cd commit 2fde308

File tree

2 files changed

+35
-0
lines changed

2 files changed

+35
-0
lines changed

ext/opcache/jit/zend_jit_helpers.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -690,6 +690,9 @@ static zval* ZEND_FASTCALL zend_jit_fetch_dim_rw_helper(zend_array *ht, zval *di
690690
case IS_UNDEF:
691691
execute_data = EG(current_execute_data);
692692
opline = EX(opline);
693+
if (UNEXPECTED(opline->opcode == ZEND_HANDLE_EXCEPTION)) {
694+
opline = EG(opline_before_exception);
695+
}
693696
if (!zend_jit_undefined_op_helper_write(ht, opline->op2.var)) {
694697
if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
695698
if (EG(exception)) {
Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
--TEST--
2+
JIT ASSIGN_DIM_OP: Undefined variable and index with exception
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.jit_buffer_size=1M
8+
--FILE--
9+
<?php
10+
set_error_handler(function($_, $m){
11+
throw new Exception($m);
12+
});
13+
function test1() {
14+
$res = $a[$undef] = null;
15+
}
16+
function test2() {
17+
$res = $a[$undef] += 1;
18+
}
19+
try {
20+
test1();
21+
} catch (Exception $e) {
22+
echo $e->getMessage(), "\n";
23+
}
24+
try {
25+
test2();
26+
} catch (Exception $e) {
27+
echo $e->getMessage(), "\n";
28+
}
29+
?>
30+
--EXPECT--
31+
Undefined variable $undef
32+
Undefined variable $a

0 commit comments

Comments
 (0)