@@ -2046,7 +2046,7 @@ static uint32_t assign_dim_result_type(
2046
2046
2047
2047
/* For binary ops that have compound assignment operators */
2048
2048
static uint32_t binary_op_result_type (
2049
- zend_ssa * ssa , zend_uchar opcode , uint32_t t1 , uint32_t t2 , uint32_t result_var ,
2049
+ zend_ssa * ssa , zend_uchar opcode , uint32_t t1 , uint32_t t2 , int result_var ,
2050
2050
zend_long optimization_level ) {
2051
2051
uint32_t tmp = 0 ;
2052
2052
uint32_t t1_type = (t1 & MAY_BE_ANY ) | (t1 & MAY_BE_UNDEF ? MAY_BE_NULL : 0 );
@@ -2064,7 +2064,8 @@ static uint32_t binary_op_result_type(
2064
2064
switch (opcode ) {
2065
2065
case ZEND_ADD :
2066
2066
if (t1_type == MAY_BE_LONG && t2_type == MAY_BE_LONG ) {
2067
- if (!ssa -> var_info [result_var ].has_range ||
2067
+ if (result_var < 0 ||
2068
+ !ssa -> var_info [result_var ].has_range ||
2068
2069
ssa -> var_info [result_var ].range .underflow ||
2069
2070
ssa -> var_info [result_var ].range .overflow ) {
2070
2071
/* may overflow */
@@ -2090,7 +2091,8 @@ static uint32_t binary_op_result_type(
2090
2091
case ZEND_SUB :
2091
2092
case ZEND_MUL :
2092
2093
if (t1_type == MAY_BE_LONG && t2_type == MAY_BE_LONG ) {
2093
- if (!ssa -> var_info [result_var ].has_range ||
2094
+ if (result_var < 0 ||
2095
+ !ssa -> var_info [result_var ].has_range ||
2094
2096
ssa -> var_info [result_var ].range .underflow ||
2095
2097
ssa -> var_info [result_var ].range .overflow ) {
2096
2098
/* may overflow */
@@ -2534,7 +2536,8 @@ static zend_always_inline int _zend_update_type_info(
2534
2536
}
2535
2537
2536
2538
tmp |= binary_op_result_type (
2537
- ssa , opline -> extended_value , t1 , t2 , ssa_op -> op1_def , optimization_level );
2539
+ ssa , opline -> extended_value , t1 , t2 ,
2540
+ opline -> opcode == ZEND_ASSIGN_OP ? ssa_op -> op1_def : -1 , optimization_level );
2538
2541
if (tmp & (MAY_BE_STRING |MAY_BE_ARRAY )) {
2539
2542
tmp |= MAY_BE_RC1 ;
2540
2543
}
0 commit comments