Skip to content

Commit c4a1100

Browse files
authored
Fix unevaluated rhs of class constant fetch in constant expression (#11047)
Fixes oss-fuzz #57821
1 parent 4082d42 commit c4a1100

File tree

2 files changed

+15
-3
lines changed

2 files changed

+15
-3
lines changed

Zend/tests/oss_fuzz_57821.phpt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
--TEST--
2+
oss-fuzz #57821: Unevaluated rhs of class constant fetch in constant expression
3+
--FILE--
4+
<?php
5+
class Foo {
6+
const Foo = 'foo';
7+
}
8+
const C = Foo::{Foo::class};
9+
var_dump(C);
10+
?>
11+
--EXPECT--
12+
string(3) "foo"

Zend/zend_compile.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10761,14 +10761,14 @@ static void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */
1076110761
zend_ast *name_ast;
1076210762
zend_string *resolved_name;
1076310763

10764+
zend_eval_const_expr(&ast->child[0]);
10765+
zend_eval_const_expr(&ast->child[1]);
10766+
1076410767
if (UNEXPECTED(ast->child[1]->kind != ZEND_AST_ZVAL
1076510768
|| Z_TYPE_P(zend_ast_get_zval(ast->child[1])) != IS_STRING)) {
1076610769
return;
1076710770
}
1076810771

10769-
zend_eval_const_expr(&ast->child[0]);
10770-
zend_eval_const_expr(&ast->child[1]);
10771-
1077210772
class_ast = ast->child[0];
1077310773
name_ast = ast->child[1];
1077410774

0 commit comments

Comments
 (0)