Skip to content

Commit 8446e28

Browse files
committed
Handle missing result_var in binary_op_result_type
For dim/obj compound ops we don't have a result_var. Not sure why this never caused issues before, but this can crash with JIT.
1 parent 99a6877 commit 8446e28

File tree

1 file changed

+7
-4
lines changed

1 file changed

+7
-4
lines changed

ext/opcache/Optimizer/zend_inference.c

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2046,7 +2046,7 @@ static uint32_t assign_dim_result_type(
20462046

20472047
/* For binary ops that have compound assignment operators */
20482048
static uint32_t binary_op_result_type(
2049-
zend_ssa *ssa, zend_uchar opcode, uint32_t t1, uint32_t t2, uint32_t result_var,
2049+
zend_ssa *ssa, zend_uchar opcode, uint32_t t1, uint32_t t2, int result_var,
20502050
zend_long optimization_level) {
20512051
uint32_t tmp = 0;
20522052
uint32_t t1_type = (t1 & MAY_BE_ANY) | (t1 & MAY_BE_UNDEF ? MAY_BE_NULL : 0);
@@ -2064,7 +2064,8 @@ static uint32_t binary_op_result_type(
20642064
switch (opcode) {
20652065
case ZEND_ADD:
20662066
if (t1_type == MAY_BE_LONG && t2_type == MAY_BE_LONG) {
2067-
if (!ssa->var_info[result_var].has_range ||
2067+
if (result_var < 0 ||
2068+
!ssa->var_info[result_var].has_range ||
20682069
ssa->var_info[result_var].range.underflow ||
20692070
ssa->var_info[result_var].range.overflow) {
20702071
/* may overflow */
@@ -2090,7 +2091,8 @@ static uint32_t binary_op_result_type(
20902091
case ZEND_SUB:
20912092
case ZEND_MUL:
20922093
if (t1_type == MAY_BE_LONG && t2_type == MAY_BE_LONG) {
2093-
if (!ssa->var_info[result_var].has_range ||
2094+
if (result_var < 0 ||
2095+
!ssa->var_info[result_var].has_range ||
20942096
ssa->var_info[result_var].range.underflow ||
20952097
ssa->var_info[result_var].range.overflow) {
20962098
/* may overflow */
@@ -2534,7 +2536,8 @@ static zend_always_inline int _zend_update_type_info(
25342536
}
25352537

25362538
tmp |= binary_op_result_type(
2537-
ssa, opline->extended_value, t1, t2, ssa_op->op1_def, optimization_level);
2539+
ssa, opline->extended_value, t1, t2,
2540+
opline->opcode == ZEND_ASSIGN_OP ? ssa_op->op1_def : -1, optimization_level);
25382541
if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY)) {
25392542
tmp |= MAY_BE_RC1;
25402543
}

0 commit comments

Comments
 (0)