Skip to content

Commit eae0610

Browse files
laruencelaruence
committed
Fixed bug #62653: (unset($array[$float]) causes a crash)
the reason why jpauli and I can not reproduce is (it's silly): I typo "USE_ZEND_ALLOC *&&* valgrind" at the first time, then I always ctrl+r and jpauli copied my command from the pastbin :) thanks
1 parent ba27e08 commit eae0610

4 files changed

Lines changed: 61 additions & 13 deletions

File tree

‎NEWS‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ PHP NEWS
55
- Core:
66
. Fixed bug #62661 (Interactive php-cli crashes if include() is used in
77
auto_prepend_file). (Laruence)
8+
. Fixed bug #62653: (unset($array[$float]) causes a crash). (Nikita Popov,
9+
Laruence)
810
. Fixed bug #62565 (Crashes due non-initialized internal properties_table).
911
(Felipe)
1012

‎Zend/tests/bug62653.phpt‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
--TEST--
2+
Bug #62653: unset($array[$float]) causes a crash
3+
--FILE--
4+
<?php
5+
$array = array("5"=>"bar");
6+
$foo = "10.0000"; // gettype($foo) = "string"
7+
$foo /= 2; //Makes $foo = 5 but still gettype($foo) = "double"
8+
unset($array[$foo]);
9+
print_r($array);
10+
11+
$array = array("5"=>"bar");
12+
$foo = "5";
13+
unset($array[(float)$foo]);
14+
print_r($array);
15+
16+
$array = array("5"=>"bar");
17+
$foo = "5";
18+
$foo /= 2; //Makes $foo = 5 but still gettype($foo) = "double"
19+
$name = "foo";
20+
unset($array[$$name]);
21+
print_r($array);
22+
23+
?>
24+
--EXPECT--
25+
Array
26+
(
27+
)
28+
Array
29+
(
30+
)
31+
Array
32+
(
33+
)

‎Zend/zend_vm_def.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3947,7 +3947,8 @@ ZEND_VM_HANDLER(75, ZEND_UNSET_DIM, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
39473947
switch (Z_TYPE_P(offset)) {
39483948
case IS_DOUBLE:
39493949
hval = zend_dval_to_lval(Z_DVAL_P(offset));
3950-
ZEND_VM_C_GOTO(num_index_dim);
3950+
zend_hash_index_del(ht, hval);
3951+
break;
39513952
case IS_RESOURCE:
39523953
case IS_BOOL:
39533954
case IS_LONG:

‎Zend/zend_vm_execute.h‎

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -13917,7 +13917,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HAND
1391713917
switch (Z_TYPE_P(offset)) {
1391813918
case IS_DOUBLE:
1391913919
hval = zend_dval_to_lval(Z_DVAL_P(offset));
13920-
goto num_index_dim;
13920+
zend_hash_index_del(ht, hval);
13921+
break;
1392113922
case IS_RESOURCE:
1392213923
case IS_BOOL:
1392313924
case IS_LONG:
@@ -15919,7 +15920,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLE
1591915920
switch (Z_TYPE_P(offset)) {
1592015921
case IS_DOUBLE:
1592115922
hval = zend_dval_to_lval(Z_DVAL_P(offset));
15922-
goto num_index_dim;
15923+
zend_hash_index_del(ht, hval);
15924+
break;
1592315925
case IS_RESOURCE:
1592415926
case IS_BOOL:
1592515927
case IS_LONG:
@@ -18131,7 +18133,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLE
1813118133
switch (Z_TYPE_P(offset)) {
1813218134
case IS_DOUBLE:
1813318135
hval = zend_dval_to_lval(Z_DVAL_P(offset));
18134-
goto num_index_dim;
18136+
zend_hash_index_del(ht, hval);
18137+
break;
1813518138
case IS_RESOURCE:
1813618139
case IS_BOOL:
1813718140
case IS_LONG:
@@ -21166,7 +21169,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER
2116621169
switch (Z_TYPE_P(offset)) {
2116721170
case IS_DOUBLE:
2116821171
hval = zend_dval_to_lval(Z_DVAL_P(offset));
21169-
goto num_index_dim;
21172+
zend_hash_index_del(ht, hval);
21173+
break;
2117021174
case IS_RESOURCE:
2117121175
case IS_BOOL:
2117221176
case IS_LONG:
@@ -22504,7 +22508,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_H
2250422508
switch (Z_TYPE_P(offset)) {
2250522509
case IS_DOUBLE:
2250622510
hval = zend_dval_to_lval(Z_DVAL_P(offset));
22507-
goto num_index_dim;
22511+
zend_hash_index_del(ht, hval);
22512+
break;
2250822513
case IS_RESOURCE:
2250922514
case IS_BOOL:
2251022515
case IS_LONG:
@@ -23662,7 +23667,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HAN
2366223667
switch (Z_TYPE_P(offset)) {
2366323668
case IS_DOUBLE:
2366423669
hval = zend_dval_to_lval(Z_DVAL_P(offset));
23665-
goto num_index_dim;
23670+
zend_hash_index_del(ht, hval);
23671+
break;
2366623672
case IS_RESOURCE:
2366723673
case IS_BOOL:
2366823674
case IS_LONG:
@@ -24820,7 +24826,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HAN
2482024826
switch (Z_TYPE_P(offset)) {
2482124827
case IS_DOUBLE:
2482224828
hval = zend_dval_to_lval(Z_DVAL_P(offset));
24823-
goto num_index_dim;
24829+
zend_hash_index_del(ht, hval);
24830+
break;
2482424831
case IS_RESOURCE:
2482524832
case IS_BOOL:
2482624833
case IS_LONG:
@@ -26244,7 +26251,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HAND
2624426251
switch (Z_TYPE_P(offset)) {
2624526252
case IS_DOUBLE:
2624626253
hval = zend_dval_to_lval(Z_DVAL_P(offset));
26247-
goto num_index_dim;
26254+
zend_hash_index_del(ht, hval);
26255+
break;
2624826256
case IS_RESOURCE:
2624926257
case IS_BOOL:
2625026258
case IS_LONG:
@@ -29498,7 +29506,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDL
2949829506
switch (Z_TYPE_P(offset)) {
2949929507
case IS_DOUBLE:
2950029508
hval = zend_dval_to_lval(Z_DVAL_P(offset));
29501-
goto num_index_dim;
29509+
zend_hash_index_del(ht, hval);
29510+
break;
2950229511
case IS_RESOURCE:
2950329512
case IS_BOOL:
2950429513
case IS_LONG:
@@ -31371,7 +31380,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER
3137131380
switch (Z_TYPE_P(offset)) {
3137231381
case IS_DOUBLE:
3137331382
hval = zend_dval_to_lval(Z_DVAL_P(offset));
31374-
goto num_index_dim;
31383+
zend_hash_index_del(ht, hval);
31384+
break;
3137531385
case IS_RESOURCE:
3137631386
case IS_BOOL:
3137731387
case IS_LONG:
@@ -33453,7 +33463,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER
3345333463
switch (Z_TYPE_P(offset)) {
3345433464
case IS_DOUBLE:
3345533465
hval = zend_dval_to_lval(Z_DVAL_P(offset));
33456-
goto num_index_dim;
33466+
zend_hash_index_del(ht, hval);
33467+
break;
3345733468
case IS_RESOURCE:
3345833469
case IS_BOOL:
3345933470
case IS_LONG:
@@ -36219,7 +36230,8 @@ static int ZEND_FASTCALL ZEND_UNSET_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_
3621936230
switch (Z_TYPE_P(offset)) {
3622036231
case IS_DOUBLE:
3622136232
hval = zend_dval_to_lval(Z_DVAL_P(offset));
36222-
goto num_index_dim;
36233+
zend_hash_index_del(ht, hval);
36234+
break;
3622336235
case IS_RESOURCE:
3622436236
case IS_BOOL:
3622536237
case IS_LONG:

0 commit comments

Comments
 (0)