archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix $GLOBALS[] in isset and unset

Browse source 
I've previously addressed the case of assignments, but the same
issue exists for isset and unset.

Fixes oss-fuzz #29699.
This commit is contained in:
Nikita Popov 2021-01-18 10:31:38 +01:00
parent a3e55286a6
commit 9862296d46
3 changed files with 24 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Zend/tests/restrict_globals/invalid_append_isset.phpt Normal file
View file

@ -0,0 +1,8 @@
--TEST--
Cannot append to $GLOBALS in isset()
--FILE--
<?php
isset($GLOBALS[]);
?>
--EXPECTF--
Fatal error: Cannot use [] for reading in %s on line %d

8
Zend/tests/restrict_globals/invalid_append_unset.phpt Normal file
View file

@ -0,0 +1,8 @@
--TEST--
Cannot append to $GLOBALS in unset()
--FILE--
<?php
unset($GLOBALS[]);
?>
--EXPECTF--
Fatal error: Cannot use [] for unsetting in %s on line %d

8
Zend/zend_compile.c
View file

@ -4692,6 +4692,10 @@ void zend_compile_unset(zend_ast *ast) /* {{{ */
zend_ensure_writable_variable(var_ast);
if (is_global_var_fetch(var_ast)) {
if (!var_ast->child[1]) {
zend_error_noreturn(E_COMPILE_ERROR, "Cannot use [] for unsetting");
}
zend_compile_expr(&var_node, var_ast->child[1]);
if (var_node.op_type == IS_CONST) {
convert_to_string(&var_node.u.constant);
@ -8790,6 +8794,10 @@ void zend_compile_isset_or_empty(znode *result, zend_ast *ast) /* {{{ */
}
if (is_global_var_fetch(var_ast)) {
if (!var_ast->child[1]) {
zend_error_noreturn(E_COMPILE_ERROR, "Cannot use [] for reading");
}
zend_compile_expr(&var_node, var_ast->child[1]);
if (var_node.op_type == IS_CONST) {
convert_to_string(&var_node.u.constant);