diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 39387b9fcda..2799b2a5bb5 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -1949,6 +1949,10 @@ int zend_fetch_dim_unset_handler(ZEND_OPCODE_HANDLER_ARGS) if (EX_T(EX(opline)->result.u.var).EA.type == IS_STRING_OFFSET) { zend_error(E_ERROR, "Cannot unset string offsets"); } else { + if (Z_TYPE_PP(EX_T(EX(opline)->result.u.var).var.ptr_ptr) != IS_ARRAY) { + zend_error(E_ERROR, "Illegal scalar dereference"); + } + PZVAL_UNLOCK(*EX_T(EX(opline)->result.u.var).var.ptr_ptr); if (EX_T(EX(opline)->result.u.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) { SEPARATE_ZVAL_IF_NOT_REF(EX_T(EX(opline)->result.u.var).var.ptr_ptr);