Skip to content

Commit 93e78d4

Browse files
GirgiasGirgias
committed
Address review comments
1 parent 81302a0 commit 93e78d4

File tree

6 files changed

+34
-32
lines changed

6 files changed

+34
-32
lines changed

‎Zend/tests/bug24773.phpt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Bug #24773 (unset() of integers treated as arrays causes a crash)
66
unset($array["lvl1"]["lvl2"]["b"]);
77
?>
88
--EXPECTF--
9-
Fatal error: Uncaught TypeError: Cannot access offset of type string on string in %s:%d
9+
Fatal error: Uncaught TypeError: Cannot access offset of type string in unset in %s:%d
1010
Stack trace:
1111
#0 {main}
1212
thrown in %s on line %d

‎Zend/zend_execute.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1591,7 +1591,7 @@ static zend_never_inline zend_long zend_check_string_offset(zval *dim, int type
15911591
}
15921592
return offset;
15931593
}
1594-
zend_illegal_container_offset("string", dim, BP_VAR_R);
1594+
zend_illegal_container_offset("string", dim, type);
15951595
return 0;
15961596
}
15971597
case IS_UNDEF:
@@ -1607,7 +1607,7 @@ static zend_never_inline zend_long zend_check_string_offset(zval *dim, int type
16071607
dim = Z_REFVAL_P(dim);
16081608
goto try_again;
16091609
default:
1610-
zend_illegal_container_offset("string", dim, BP_VAR_R);
1610+
zend_illegal_container_offset("string", dim, type);
16111611
return 0;
16121612
}
16131613

@@ -2404,7 +2404,7 @@ static zend_never_inline zend_uchar slow_index_convert_w(HashTable *ht, const zv
24042404
value->lval = 1;
24052405
return IS_LONG;
24062406
default:
2407-
zend_illegal_container_offset("array", dim, BP_VAR_R);
2407+
zend_illegal_container_offset("array", dim, BP_VAR_W);
24082408
return IS_NULL;
24092409
}
24102410
}

‎Zend/zend_vm_def.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6069,7 +6069,7 @@ ZEND_VM_C_LABEL(num_index):
60696069
str = ZSTR_EMPTY_ALLOC();
60706070
ZEND_VM_C_GOTO(str_index);
60716071
} else {
6072-
zend_illegal_container_offset("array", offset, BP_VAR_R);
6072+
zend_illegal_container_offset("array", offset, BP_VAR_W);
60736073
zval_ptr_dtor_nogc(expr_ptr);
60746074
}
60756075
FREE_OP2();

‎Zend/zend_vm_execute.h

Lines changed: 16 additions & 16 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎ext/opcache/jit/zend_jit_helpers.c

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -620,7 +620,7 @@ static void ZEND_FASTCALL zend_jit_fetch_dim_is_helper(zend_array *ht, zval *dim
620620
hval = 1;
621621
goto num_index;
622622
default:
623-
zend_illegal_container_offset("array", dim, BP_VAR_R);
623+
zend_illegal_container_offset("array", dim, BP_VAR_IS);
624624
undef_result_after_exception();
625625
return;
626626
}
@@ -858,7 +858,7 @@ static zval* ZEND_FASTCALL zend_jit_fetch_dim_rw_helper(zend_array *ht, zval *di
858858
hval = 1;
859859
goto num_index;
860860
default:
861-
zend_illegal_container_offset("array", dim, BP_VAR_R);
861+
zend_illegal_container_offset("array", dim, BP_VAR_RW);
862862
undef_result_after_exception();
863863
return NULL;
864864
}
@@ -1014,7 +1014,8 @@ static zval* ZEND_FASTCALL zend_jit_fetch_dim_w_helper(zend_array *ht, zval *dim
10141014
return retval;
10151015
}
10161016

1017-
static zend_never_inline zend_long zend_check_string_offset(zval *dim/*, int type*/)
1017+
/* type is one of the BP_VAR_* constants */
1018+
static zend_never_inline zend_long zend_check_string_offset(zval *dim, int type)
10181019
{
10191020
zend_long offset;
10201021

@@ -1050,7 +1051,7 @@ static zend_never_inline zend_long zend_check_string_offset(zval *dim/*, int typ
10501051
dim = Z_REFVAL_P(dim);
10511052
goto try_again;
10521053
default:
1053-
zend_illegal_container_offset("string", dim, BP_VAR_R);
1054+
zend_illegal_container_offset("string", dim, type);
10541055
return 0;
10551056
}
10561057

@@ -1088,7 +1089,7 @@ static zend_string* ZEND_FASTCALL zend_jit_fetch_dim_str_r_helper(zend_string *s
10881089
if (!(GC_FLAGS(str) & IS_STR_INTERNED)) {
10891090
GC_ADDREF(str);
10901091
}
1091-
offset = zend_check_string_offset(dim/*, BP_VAR_R*/);
1092+
offset = zend_check_string_offset(dim, BP_VAR_R);
10921093
if (!(GC_FLAGS(str) & IS_STR_INTERNED) && UNEXPECTED(GC_DELREF(str) == 0)) {
10931094
zend_string *ret = zend_jit_fetch_dim_str_offset(str, offset);
10941095
zend_string_efree(str);
@@ -1125,7 +1126,7 @@ static void ZEND_FASTCALL zend_jit_fetch_dim_str_is_helper(zend_string *str, zva
11251126
dim = Z_REFVAL_P(dim);
11261127
goto try_string_offset;
11271128
default:
1128-
zend_illegal_container_offset("string", dim, BP_VAR_R);
1129+
zend_illegal_container_offset("string", dim, BP_VAR_IS);
11291130
break;
11301131
}
11311132

@@ -1227,7 +1228,7 @@ static zend_never_inline void zend_assign_to_string_offset(zval *str, zval *dim,
12271228
/* The string may be destroyed while throwing the notice.
12281229
* Temporarily increase the refcount to detect this situation. */
12291230
GC_ADDREF(s);
1230-
offset = zend_check_string_offset(dim/*, BP_VAR_W*/);
1231+
offset = zend_check_string_offset(dim, BP_VAR_W);
12311232
if (UNEXPECTED(GC_DELREF(s) == 0)) {
12321233
zend_string_efree(s);
12331234
if (result) {
@@ -1403,7 +1404,7 @@ static zend_always_inline void ZEND_FASTCALL zend_jit_fetch_dim_obj_helper(zval
14031404
zend_throw_error(NULL, "[] operator not supported for strings");
14041405
} else {
14051406
if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
1406-
zend_check_string_offset(dim/*, BP_VAR_RW*/);
1407+
zend_check_string_offset(dim, BP_VAR_RW);
14071408
}
14081409
zend_wrong_string_offset_error();
14091410
}
@@ -1591,7 +1592,7 @@ static void ZEND_FASTCALL zend_jit_assign_dim_op_helper(zval *container, zval *d
15911592
zend_throw_error(NULL, "[] operator not supported for strings");
15921593
} else {
15931594
if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
1594-
zend_check_string_offset(dim/*, BP_VAR_RW*/);
1595+
zend_check_string_offset(dim, BP_VAR_RW);
15951596
}
15961597
zend_wrong_string_offset_error();
15971598
}

‎ext/spl/spl_array.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,8 @@ static void spl_hash_key_release(spl_hash_key *key) {
246246
}
247247
}
248248

249+
/* This function does not throw any exceptions for illegal offsets, calls to
250+
* zend_illegal_container_offset(); need to be made if the return value is FAILURE */
249251
static zend_result get_hash_key(spl_hash_key *key, spl_array_object *intern, zval *offset)
250252
{
251253
key->release_key = false;
@@ -286,7 +288,6 @@ static zend_result get_hash_key(spl_hash_key *key, spl_array_object *intern, zva
286288
ZVAL_DEREF(offset);
287289
goto try_again;
288290
default:
289-
zend_illegal_container_offset("ArrayObject", offset, BP_VAR_R);
290291
return FAILURE;
291292
}
292293

@@ -466,7 +467,7 @@ static void spl_array_write_dimension_ex(int check_inherited, zend_object *objec
466467
}
467468

468469
if (get_hash_key(&key, intern, offset) == FAILURE) {
469-
zend_illegal_container_offset("ArrayObject", offset, BP_VAR_R);
470+
zend_illegal_container_offset("ArrayObject", offset, BP_VAR_W);
470471
zval_ptr_dtor(value);
471472
return;
472473
}

0 commit comments

Comments
 (0)