php-src/Zend/tests/div_by_zero_compound_refcounted.phpt
Nikita Popov 62ecf54f35 Fix use after free on compound division by zero
We can't destroy the result operand early, because the division
might fail, in which case we need to preserve the original value.
Place the division result in a temporary zval, and only copy it
on success.

Fixes oss-fuzz #35876.
2021-07-07 09:38:30 +02:00

17 lines
258 B
PHP

--TEST--
Division by zero in compound assignment with refcounted operand
--FILE--
<?php
$h = "1";
$h .= "2";
try {
$h /= 0;
} catch (DivisionByZeroError $e) {
echo $e->getMessage(), "\n";
}
var_dump($h);
?>
--EXPECT--
Division by zero
string(2) "12"