Fix Bug #81160: isset/empty doesn't throw a TypeError on invalid stri…

…ng offset
php · Apr 5, 2022 · 7e04ded · 7e04ded
1 parent 012ef79
commit 7e04ded
Show file tree

Hide file tree

Showing 12 changed files with 372 additions and 218 deletions.
diff --git a/Zend/Optimizer/zend_inference.c b/Zend/Optimizer/zend_inference.c
@@ -4807,7 +4807,7 @@ ZEND_API bool zend_may_throw_ex(const zend_op *opline, const zend_ssa_op *ssa_op
 				return 0;
 			}
 		case ZEND_FETCH_IS:
-			return (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT));
+			return (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_STRING));
 		case ZEND_ISSET_ISEMPTY_DIM_OBJ:
 			return (t1 & MAY_BE_OBJECT) || (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT));
 		case ZEND_FETCH_DIM_IS:

diff --git a/Zend/tests/bug31098.phpt b/Zend/tests/bug31098.phpt
@@ -9,11 +9,26 @@ var_dump(isset($a->b));
 $a = '0';
 var_dump(isset($a->b));
 $a = '';
-var_dump(isset($a['b']));
+
+try {
+    var_dump(isset($a['b']));
+} catch (\TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
 $a = 'a';
-var_dump(isset($a['b']));
+
+try {
+    var_dump(isset($a['b']));
+} catch (\TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
 $a = '0';
-var_dump(isset($a['b']));
+
+try {
+    var_dump(isset($a['b']));
+} catch (\TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
 
 $simpleString = "Bogus String Text";
 echo isset($simpleString->wrong)?"bug\n":"ok\n";
@@ -46,11 +61,11 @@ echo $simpleString["0"] === "B"?"ok\n":"bug\n";
 bool(false)
 bool(false)
 bool(false)
-bool(false)
-bool(false)
-bool(false)
-ok
+Cannot access offset of type string on string
+Cannot access offset of type string on string
+Cannot access offset of type string on string
 ok
+Cannot access offset of type string on string
 ok
 ok
 ok

diff --git a/Zend/tests/bug60362.phpt b/Zend/tests/bug60362.phpt
@@ -4,12 +4,17 @@ Bug #60362: non-existent sub-sub keys should not have values
 <?php
 $arr = array('exists' => 'foz');
 
-if (isset($arr['exists']['non_existent'])) {
-    echo "sub-key 'non_existent' is set: ";
-    var_dump($arr['exists']['non_existent']);
-} else {
-    echo "sub-key 'non_existent' is not set.\n";
+try {
+    if (isset($arr['exists']['non_existent'])) {
+        echo "sub-key 'non_existent' is set: ";
+        var_dump($arr['exists']['non_existent']);
+    } else {
+        echo "sub-key 'non_existent' is not set.\n";
+    }
+} catch (\TypeError $e) {
+    echo $e->getMessage(), \PHP_EOL;
 }
+
 if (isset($arr['exists'][1])) {
     echo "sub-key 1 is set: ";
     var_dump($arr['exists'][1]);
@@ -18,11 +23,15 @@ if (isset($arr['exists'][1])) {
 }
 
 echo "-------------------\n";
-if (isset($arr['exists']['non_existent']['sub_sub'])) {
-    echo "sub-key 'sub_sub' is set: ";
-    var_dump($arr['exists']['non_existent']['sub_sub']);
-} else {
-    echo "sub-sub-key 'sub_sub' is not set.\n";
+try {
+    if (isset($arr['exists']['non_existent']['sub_sub'])) {
+        echo "sub-key 'sub_sub' is set: ";
+        var_dump($arr['exists']['non_existent']['sub_sub']);
+    } else {
+        echo "sub-sub-key 'sub_sub' is not set.\n";
+    }
+} catch (\TypeError $e) {
+    echo $e->getMessage(), \PHP_EOL;
 }
 if (isset($arr['exists'][1][0])) {
     echo "sub-sub-key 0 is set: ";
@@ -32,11 +41,15 @@ if (isset($arr['exists'][1][0])) {
 }
 
 echo "-------------------\n";
-if (empty($arr['exists']['non_existent'])) {
-    echo "sub-key 'non_existent' is empty.\n";
-} else {
-    echo "sub-key 'non_existent' is not empty: ";
-    var_dump($arr['exists']['non_existent']);
+try {
+    if (empty($arr['exists']['non_existent'])) {
+        echo "sub-key 'non_existent' is empty.\n";
+    } else {
+        echo "sub-key 'non_existent' is not empty: ";
+        var_dump($arr['exists']['non_existent']);
+    }
+} catch (\TypeError $e) {
+    echo $e->getMessage(), \PHP_EOL;
 }
 if (empty($arr['exists'][1])) {
     echo "sub-key 1 is empty.\n";
@@ -46,11 +59,15 @@ if (empty($arr['exists'][1])) {
 }
 
 echo "-------------------\n";
-if (empty($arr['exists']['non_existent']['sub_sub'])) {
-    echo "sub-sub-key 'sub_sub' is empty.\n";
-} else {
-    echo "sub-sub-key 'sub_sub' is not empty: ";
-    var_dump($arr['exists']['non_existent']['sub_sub']);
+try {
+    if (empty($arr['exists']['non_existent']['sub_sub'])) {
+        echo "sub-sub-key 'sub_sub' is empty.\n";
+    } else {
+        echo "sub-sub-key 'sub_sub' is not empty: ";
+        var_dump($arr['exists']['non_existent']['sub_sub']);
+    }
+} catch (\TypeError $e) {
+    echo $e->getMessage(), \PHP_EOL;
 }
 if (empty($arr['exists'][1][0])) {
     echo "sub-sub-key 0 is empty.\n";
@@ -61,15 +78,15 @@ if (empty($arr['exists'][1][0])) {
 echo "DONE";
 ?>
 --EXPECT--
-sub-key 'non_existent' is not set.
+Cannot access offset of type string on string
 sub-key 1 is set: string(1) "o"
 -------------------
-sub-sub-key 'sub_sub' is not set.
+Cannot access offset of type string on string
 sub-sub-key 0 is set: string(1) "o"
 -------------------
-sub-key 'non_existent' is empty.
+Cannot access offset of type string on string
 sub-key 1 is not empty: string(1) "o"
 -------------------
-sub-sub-key 'sub_sub' is empty.
+Cannot access offset of type string on string
 sub-sub-key 0 is not empty: string(1) "o"
 DONE
diff --git a/Zend/tests/bug62680.phpt b/Zend/tests/bug62680.phpt
@@ -3,9 +3,17 @@ Bug #62680 (Function isset() throws fatal error on set array if non-existent key
 --FILE--
 <?php
 $array = array("");
-var_dump(isset($array[0]["a"]["b"]));
-var_dump(isset($array[0]["a"]["b"]["c"]));
+try {
+    var_dump(isset($array[0]["a"]["b"]));
+} catch (\TypeError $e) {
+    echo $e->getMessage(), \PHP_EOL;
+}
+try {
+    var_dump(isset($array[0]["a"]["b"]["c"]));
+} catch (\TypeError $e) {
+    echo $e->getMessage(), \PHP_EOL;
+}
 ?>
 --EXPECT--
-bool(false)
-bool(false)
+Cannot access offset of type string on string
+Cannot access offset of type string on string
diff --git a/Zend/tests/bug69889.phpt b/Zend/tests/bug69889.phpt
@@ -9,13 +9,22 @@ var_dump($foo[0] ?? "default");
 var_dump($foo[5] ?? "default");
 var_dump(isset($foo[5]) ? $foo[5] : "default");
 
-var_dump($foo["str"] ?? "default");
-var_dump(isset($foo["str"]) ? $foo["str"] : "default");
+try {
+    var_dump($foo["str"] ?? "default");
+} catch (\TypeError $e) {
+    echo $e->getMessage(), \PHP_EOL;
+}
+
+try {
+    var_dump(isset($foo["str"]) ? $foo["str"] : "default");
+} catch (\TypeError $e) {
+    echo $e->getMessage(), \PHP_EOL;
+}
 
 ?>
 --EXPECT--
 string(1) "t"
 string(7) "default"
 string(7) "default"
-string(7) "default"
-string(7) "default"
+Cannot access offset of type string on string
+Cannot access offset of type string on string
diff --git a/Zend/tests/bug81160.phpt b/Zend/tests/bug81160.phpt
@@ -0,0 +1,66 @@
+--TEST--
+Bug #81160: isset/empty doesn't throw a TypeError on invalid string offset
+--FILE--
+<?php
+
+$s = 'Hello';
+$o = new stdClass();
+$a = [];
+
+try {
+    var_dump(isset($s[$o]));
+} catch (\Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    var_dump(empty($s[$o]));
+} catch (\Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    var_dump($s[$o] ?? 'default');
+} catch (\Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    var_dump(isset($s[$a]));
+} catch (\Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    var_dump(empty($s[$a]));
+} catch (\Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    var_dump($s[$a] ?? 'default');
+} catch (\Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    var_dump(isset($s[[]]));
+} catch (\Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    var_dump(empty($s[[]]));
+} catch (\Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    var_dump($s[[]] ?? 'default');
+} catch (\Throwable $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Cannot access offset of type stdClass on string
+Cannot access offset of type stdClass on string
+Cannot access offset of type stdClass on string
+Cannot access offset of type array on string
+Cannot access offset of type array on string
+Cannot access offset of type array on string
+Cannot access offset of type array on string
+Cannot access offset of type array on string
+Cannot access offset of type array on string