Skip to content

Commit 770a544

Browse files
committed
Optimizer: Fix inorrect constant substitution in FETCH_LIST_R
Fixes oss-fuzz #45429
1 parent f7608df commit 770a544

File tree

2 files changed

+27
-1
lines changed

2 files changed

+27
-1
lines changed

Zend/Optimizer/block_pass.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,13 @@ static void zend_optimize_block(zend_basic_block *block, zend_op_array *op_array
166166
} else {
167167
zval c;
168168
ZVAL_COPY(&c, &ZEND_OP1_LITERAL(src));
169-
if (zend_optimizer_update_op1_const(op_array, opline, &c)) {
169+
if (opline->opcode != ZEND_CASE
170+
&& opline->opcode != ZEND_CASE_STRICT
171+
&& opline->opcode != ZEND_FETCH_LIST_R
172+
&& opline->opcode != ZEND_SWITCH_LONG
173+
&& opline->opcode != ZEND_SWITCH_STRING
174+
&& opline->opcode != ZEND_MATCH
175+
&& zend_optimizer_update_op1_const(op_array, opline, &c)) {
170176
VAR_SOURCE(op1) = NULL;
171177
literal_dtor(&ZEND_OP1_LITERAL(src));
172178
MAKE_NOP(src);
Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
--TEST--
2+
Block Pass 003: Inorrect constant substitution in FETCH_LIST_R
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.optimization_level=-1
7+
--EXTENSIONS--
8+
opcache
9+
--FILE--
10+
<?php
11+
function test() {
12+
for ($i = 0; $i < 10; $i++) {
13+
list($a, $b) = 1 ? 1 : 2;
14+
}
15+
}
16+
test();
17+
?>
18+
DONE
19+
--EXPECT--
20+
DONE

0 commit comments

Comments
 (0)