[2007-07-08 03:10 UTC] judas dot iscariote at gmail dot com

Description:
------------
this is a variation of bug #41813 that produces segmentation fault as well..



Reproduce code:
---------------
<?php

$foo="50";
$foo[3]->bar[1] = "bang";

?>


Expected result:
----------------
Fatal error: Cannot use string offset as an array.

Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
0x000000000072e990 in zend_fetch_property_address (result=0x7fffc1e290a0, container_ptr=0x0, prop_ptr=0x2b8aecc303e8, type=1)

patch:

Index: Zend/zend_execute.c
===================================================================
RCS file: /repository/ZendEngine2/zend_execute.c,v
retrieving revision 1.716.2.12.2.21
diff -u -r1.716.2.12.2.21 zend_execute.c
--- Zend/zend_execute.c 27 Jun 2007 08:51:40 -0000      1.716.2.12.2.21
+++ Zend/zend_execute.c 8 Jul 2007 03:07:33 -0000
@@ -1233,8 +1233,13 @@
 static void zend_fetch_property_address(temp_variable *result, zval **container_ptr, zval *prop_ptr, int type TSRMLS_DC)
 {
        zval *container;
+
+       if (!container_ptr) {
+               zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
+       }

        container = *container_ptr;
+
        if (container == EG(error_zval_ptr)) {
                if (result) {
                        result->var.ptr_ptr = &EG(error_zval_ptr);

 [2007-07-08 15:28 UTC] iliaa@php.net

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.