Skip to content

Fix OSS-Fuzz #568005340: FETCH_DIM_FUNC_ARG partial conversion - #24059

Open
ndossche wants to merge 1 commit into
php:PHP-8.4from
ndossche:fix-oss-fuzz-568005340
Open

ndossche wants to merge 1 commit into
php:PHP-8.4from
ndossche:fix-oss-fuzz-568005340

Conversation

@ndossche

@ndossche ndossche commented Oct 1, 2026 •

Copy link
Copy Markdown
Member

The new call is compiled to FETCH_DIM_FUNC_ARG going to FETCH_OBJ_FUNC_ARG. It tries to convert the FETCH_*_FUNC_ARG to FETCH_*_R, but it skips FETCH_DIM_FUNC_ARG with the UNUSED op2, and erroneously converts the next FETCH_OBJ_FUNC_ARG to FETCH_OBJ_R, which is an unexpected state for the optimizer.

Interestingly, the reference path already had the appropriate check, so we move the check upwards and do the same thing as the reference path.

The new call is compiled to FETCH_DIM_FUNC_ARG going to
FETCH_OBJ_FUNC_ARG. It tries to convert the FETCH_*_FUNC_ARG to FETCH_*_R, but
it skips FETCH_DIM_FUNC_ARG with the UNUSED op2, and erroneously
converts the next FETCH_OBJ_FUNC_ARG to FETCH_OBJ_R, which is an
unexpected state for the optimizer.

Interestingly, the reference path already had the appropriate check, so
we move the check upwards and do the same thing as the reference path.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant