diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2020-08-11 15:11:36 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2020-08-11 15:11:36 +0200 |
| commit | f491dabe403646a751dde52679bc817967477914 (patch) | |
| tree | 4bea361daf61c33a91952b351e324e50819d6977 /Zend/zend_vm_execute.h | |
| parent | 75baa729f53914afad456296fdbfb52d99dbfd6b (diff) | |
| download | php-git-f491dabe403646a751dde52679bc817967477914.tar.gz | |
Fix nullsafe operator on reference
Dereference the value before checking the type. As the happy path
necessarily has to check for references, I'm not bothering to
delay the comparison.
Diffstat (limited to 'Zend/zend_vm_execute.h')
| -rw-r--r-- | Zend/zend_vm_execute.h | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index b9ccb2226c..e564ec3c18 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -4375,6 +4375,9 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_JMP_NULL_SPEC_CON zval *val; val = RT_CONSTANT(opline, opline->op1); + if (IS_CONST != IS_CONST) { + ZVAL_DEREF(val); + } if (Z_TYPE_INFO_P(val) > IS_NULL) { ZEND_VM_NEXT_OPCODE(); @@ -11095,6 +11098,9 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_JMP_NULL_SPEC_TMPV zval *val; val = EX_VAR(opline->op1.var); + if ((IS_TMP_VAR|IS_VAR|IS_CV) != IS_CONST) { + ZVAL_DEREF(val); + } if (Z_TYPE_INFO_P(val) > IS_NULL) { ZEND_VM_NEXT_OPCODE(); |