Skip to content

Commit fe1633f

Browse files
committed
Undef result if undef dim warning promoted to exception
Fixes oss-fuzz #39278.
1 parent f381079 commit fe1633f

File tree

2 files changed

+40
-0
lines changed

2 files changed

+40
-0
lines changed

ext/opcache/jit/zend_jit_helpers.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -684,6 +684,7 @@ static zval* ZEND_FASTCALL zend_jit_fetch_dim_rw_helper(zend_array *ht, zval *di
684684
goto str_index;
685685
case IS_UNDEF:
686686
if (!zend_jit_undefined_op_helper_write(ht, EG(current_execute_data)->opline->op2.var)) {
687+
undef_result_after_exception();
687688
return NULL;
688689
}
689690
/* break missing intentionally */
@@ -768,6 +769,7 @@ static zval* ZEND_FASTCALL zend_jit_fetch_dim_w_helper(zend_array *ht, zval *dim
768769
goto str_index;
769770
case IS_UNDEF:
770771
if (!zend_jit_undefined_op_helper_write(ht, EG(current_execute_data)->opline->op2.var)) {
772+
undef_result_after_exception();
771773
return NULL;
772774
}
773775
/* break missing intentionally */
Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
--TEST--
2+
Undef to exception for assign dim offset
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.jit_buffer_size=1M
8+
--FILE--
9+
<?php
10+
set_error_handler(function($_, $m){
11+
throw new Exception($m);
12+
});
13+
function test1() {
14+
$a = [];
15+
$res = $a[$undef] = null;
16+
}
17+
function test2() {
18+
$a = [];
19+
$res = $a[$undef] += 1;
20+
}
21+
function test3() {
22+
$a = [];
23+
$res = isset($a[$undef]);
24+
}
25+
try {
26+
test1();
27+
} catch (Exception $e) {
28+
echo $e->getMessage(), "\n";
29+
}
30+
try {
31+
test2();
32+
} catch (Exception $e) {
33+
echo $e->getMessage(), "\n";
34+
}
35+
?>
36+
--EXPECT--
37+
Undefined variable $undef
38+
Undefined variable $undef

0 commit comments

Comments
 (0)