Skip to content

Commit c8cb68a

Browse files
committedOct 30, 2023
Fixed codegenertion for FETCH_DIM_W
Fixes oss-fuzz #63664
1 parent c1fec9b commit c8cb68a

File tree

2 files changed

+47
-0
lines changed

2 files changed

+47
-0
lines changed
 

‎ext/opcache/jit/zend_jit_ir.c

+3
Original file line numberDiff line numberDiff line change
@@ -12450,6 +12450,9 @@ static int zend_jit_fetch_dim(zend_jit_ctx *jit,
1245012450
jit_set_Z_TYPE_INFO(jit, res_addr, IS_NULL);
1245112451
end_inputs = ir_END();
1245212452
}
12453+
} else if (!(op2_info & (MAY_BE_ANY|MAY_BE_UNDEF))) {
12454+
/* impossible dead path */
12455+
end_inputs = ir_END();
1245312456
} else {
1245412457
ZEND_ASSERT(end_inputs == IR_UNUSED);
1245512458
}
+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
--TEST--
2+
JIT FETCH_DIM_W: 004
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.jit_buffer_size=1M
8+
--FILE--
9+
<?php
10+
function create_references(&$array) {
11+
foreach ($a as $key => $value) {
12+
create_references($array[$key]);
13+
}
14+
}
15+
16+
function change_copy($copy) {
17+
$copy['b']['z']['z'] = $copy['b'];
18+
}
19+
20+
$data = [
21+
'a' => [
22+
'b' => [],
23+
],
24+
];
25+
26+
@create_references($data);
27+
28+
$copy = $data['a'];
29+
var_dump($copy);
30+
31+
change_copy($copy);
32+
var_dump($copy); //RECURSION
33+
?>
34+
--EXPECT--
35+
array(1) {
36+
["b"]=>
37+
array(0) {
38+
}
39+
}
40+
array(1) {
41+
["b"]=>
42+
array(0) {
43+
}
44+
}

0 commit comments

Comments
 (0)