Skip to content

Commit 9862296

Browse files
committed
Fix $GLOBALS[] in isset and unset
I've previously addressed the case of assignments, but the same issue exists for isset and unset. Fixes oss-fuzz #29699.
1 parent a3e5528 commit 9862296

File tree

3 files changed

+24
-0
lines changed

3 files changed

+24
-0
lines changed
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
--TEST--
2+
Cannot append to $GLOBALS in isset()
3+
--FILE--
4+
<?php
5+
isset($GLOBALS[]);
6+
?>
7+
--EXPECTF--
8+
Fatal error: Cannot use [] for reading in %s on line %d
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
--TEST--
2+
Cannot append to $GLOBALS in unset()
3+
--FILE--
4+
<?php
5+
unset($GLOBALS[]);
6+
?>
7+
--EXPECTF--
8+
Fatal error: Cannot use [] for unsetting in %s on line %d

Zend/zend_compile.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4692,6 +4692,10 @@ void zend_compile_unset(zend_ast *ast) /* {{{ */
46924692
zend_ensure_writable_variable(var_ast);
46934693

46944694
if (is_global_var_fetch(var_ast)) {
4695+
if (!var_ast->child[1]) {
4696+
zend_error_noreturn(E_COMPILE_ERROR, "Cannot use [] for unsetting");
4697+
}
4698+
46954699
zend_compile_expr(&var_node, var_ast->child[1]);
46964700
if (var_node.op_type == IS_CONST) {
46974701
convert_to_string(&var_node.u.constant);
@@ -8790,6 +8794,10 @@ void zend_compile_isset_or_empty(znode *result, zend_ast *ast) /* {{{ */
87908794
}
87918795

87928796
if (is_global_var_fetch(var_ast)) {
8797+
if (!var_ast->child[1]) {
8798+
zend_error_noreturn(E_COMPILE_ERROR, "Cannot use [] for reading");
8799+
}
8800+
87938801
zend_compile_expr(&var_node, var_ast->child[1]);
87948802
if (var_node.op_type == IS_CONST) {
87958803
convert_to_string(&var_node.u.constant);

0 commit comments

Comments
 (0)