diff --git a/Zend/tests/oss_fuzz_61712.phpt b/Zend/tests/oss_fuzz_61712.phpt new file mode 100644 index 0000000000000..135f7198ca51a --- /dev/null +++ b/Zend/tests/oss_fuzz_61712.phpt @@ -0,0 +1,20 @@ +--TEST-- +OSS-Fuzz #61712 +--FILE-- +a); + } +} + +$c = new C; +set_error_handler([$c, 'error']); +$c->a %= 10; +var_dump($c->a); +?> +--EXPECT-- +Undefined property: C::$a +int(0) diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c index 8f75aa0bd6903..6ea13d1f8a656 100644 --- a/Zend/zend_object_handlers.c +++ b/Zend/zend_object_handlers.c @@ -1069,12 +1069,10 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *nam if (UNEXPECTED(!zobj->properties)) { rebuild_object_properties(zobj); } - retval = zend_hash_update(zobj->properties, name, &EG(uninitialized_zval)); - /* Notice is thrown after creation of the property, to avoid EG(std_property_info) - * being overwritten in an error handler. */ if (UNEXPECTED(type == BP_VAR_RW || type == BP_VAR_R)) { zend_error(E_WARNING, "Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name)); } + retval = zend_hash_update(zobj->properties, name, &EG(uninitialized_zval)); } } else if (zobj->ce->__get == NULL) { retval = &EG(error_zval);