Skip to content

Commit 03e2613

Browse files
committed
Merge branch 'PHP-8.4'
* PHP-8.4: Fix failed assertion with throwing __toString in binary const expr
2 parents 7bac9de + 138ebf4 commit 03e2613

File tree

2 files changed

+24
-1
lines changed

2 files changed

+24
-1
lines changed

Zend/tests/oss_fuzz_434346548.phpt

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
--TEST--
2+
OSS-Fuzz #434346548: Failed assertion with throwing __toString in binary const expr
3+
--FILE--
4+
<?php
5+
6+
class Foo {
7+
function __toString() {}
8+
}
9+
10+
function test($y = new Foo() < "") {
11+
var_dump();
12+
}
13+
14+
try {
15+
test();
16+
} catch (Error $e) {
17+
echo $e->getMessage(), "\n";
18+
}
19+
20+
?>
21+
--EXPECT--
22+
Foo::__toString(): Return value must be of type string, none returned

Zend/zend_ast.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -610,9 +610,10 @@ ZEND_API zend_result ZEND_FASTCALL zend_ast_evaluate_inner(
610610
ret = FAILURE;
611611
} else {
612612
binary_op_type op = get_binary_op(ast->attr);
613-
ret = op(result, &op1, &op2);
613+
op(result, &op1, &op2);
614614
zval_ptr_dtor_nogc(&op1);
615615
zval_ptr_dtor_nogc(&op2);
616+
ret = EG(exception) ? FAILURE : SUCCESS;
616617
}
617618
break;
618619
case ZEND_AST_GREATER:

0 commit comments

Comments
 (0)