Fix type inference for assign to string offset with invalid index.

dstogov · dstogov · commit b80d30d821e6 · 2022-01-10T16:03:54.000+03:00
Fixes oss-fuzz #43277
diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
@@ -2623,7 +2623,7 @@ static zend_always_inline int _zend_update_type_info(
 			if (ssa_op->result_def >= 0) {
 				tmp = 0;
 				if (t1 & MAY_BE_STRING) {
-					tmp |= MAY_BE_STRING;
+					tmp |= MAY_BE_STRING | MAY_BE_NULL;
 				}
 				if (t1 & (MAY_BE_ARRAY|MAY_BE_FALSE|MAY_BE_NULL|MAY_BE_UNDEF)) {
 					tmp |= (OP1_DATA_INFO() & (MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF));

Original file line number	Diff line number	Diff line change
`@@ -2623,7 +2623,7 @@ static zend_always_inline int _zend_update_type_info(`
`2623`	`2623`	`if (ssa_op->result_def >= 0) {`
`2624`	`2624`	`tmp = 0;`
`2625`	`2625`	`if (t1 & MAY_BE_STRING) {`
`2626`		`- tmp \|= MAY_BE_STRING;`
	`2626`	`+ tmp \|= MAY_BE_STRING \| MAY_BE_NULL;`
`2627`	`2627`	`}`
`2628`	`2628`	`if (t1 & (MAY_BE_ARRAY\|MAY_BE_FALSE\|MAY_BE_NULL\|MAY_BE_UNDEF)) {`
`2629`	`2629`	`tmp \|= (OP1_DATA_INFO() & (MAY_BE_ANY \| MAY_BE_ARRAY_KEY_ANY \| MAY_BE_ARRAY_OF_ANY \| MAY_BE_ARRAY_OF_REF));`