mirror of
https://github.com/php/php-src.git
synced 2025-08-16 05:58:45 +02:00
6d5ae6496c
The reference wrapper was destroyed while value still pointed into it and was later used to assign the ASSIGN_DIM return value. This could be fixed either by moving the return value assignment earlier, or by working with the value that has been stored in the array. I'm going with the latter here, because that matches what the non-NEXT codepath does via assign_to_variable more closely. Fixes oss-fuzz #36807.
13 lines
154 B
PHP
13 lines
154 B
PHP
--TEST--
|
|
Assigning rc=1 reference to next dim
|
|
--FILE--
|
|
<?php
|
|
var_dump($ary[] = [&$x] = $x);
|
|
var_dump($x);
|
|
?>
|
|
--EXPECT--
|
|
array(1) {
|
|
[0]=>
|
|
&NULL
|
|
}
|
|
NULL
|