php-src/Zend/tests/str_offset_006.phpt
Dmitry Stogov 09547c64c2 Fix clobering of operand by error handler in assignment to string offset
In some cases new code requires two reallocations insead of one.

Fixes oss-fuzz #31716, #36196, #39739 and #40002
2021-12-02 00:24:05 +03:00

17 lines
319 B
PHP

--TEST--
string offset 006 indirect string modification by error handler
--FILE--
<?php
set_error_handler(function($code, $msg) {
echo "Err: $msg\n";
$GLOBALS['a']=null;
});
$a[$y]=$a.=($y);
var_dump($a);
?>
--EXPECT--
Err: Undefined variable $y
Err: Undefined variable $y
Err: String offset cast occurred
NULL