diff --git a/Zend/tests/oss_fuzz_57821.phpt b/Zend/tests/oss_fuzz_57821.phpt new file mode 100644 index 0000000000000..5c6e9fab9a8e9 --- /dev/null +++ b/Zend/tests/oss_fuzz_57821.phpt @@ -0,0 +1,12 @@ +--TEST-- +oss-fuzz #57821: Unevaluated rhs of class constant fetch in constant expression +--FILE-- + +--EXPECT-- +string(3) "foo" diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index 11df76fbf7d78..6aa5bd15a990b 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -10761,14 +10761,14 @@ static void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */ zend_ast *name_ast; zend_string *resolved_name; + zend_eval_const_expr(&ast->child[0]); + zend_eval_const_expr(&ast->child[1]); + if (UNEXPECTED(ast->child[1]->kind != ZEND_AST_ZVAL || Z_TYPE_P(zend_ast_get_zval(ast->child[1])) != IS_STRING)) { return; } - zend_eval_const_expr(&ast->child[0]); - zend_eval_const_expr(&ast->child[1]); - class_ast = ast->child[0]; name_ast = ast->child[1];