From eee1617f38a7595c48d8d2dc20219cb94e53cb67 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sun, 3 Sep 2023 15:59:23 +0200
Subject: [PATCH] Tweak behaviour of dynamic properties wrt error handlers

With the fix in https://github.com/php/php-src/pull/12114, the behaviour
would change for non-dynamic properties. Align the behaviour for dynamic
properties to be the same.

Closes GH-12117.
---
 Zend/tests/oss_fuzz_61712b.phpt | 20 ++++++++++++++++++++
 Zend/zend_object_handlers.c     |  2 +-
 2 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 Zend/tests/oss_fuzz_61712b.phpt

diff --git a/Zend/tests/oss_fuzz_61712b.phpt b/Zend/tests/oss_fuzz_61712b.phpt
new file mode 100644
index 0000000000000..8ee93b97b432d
--- /dev/null
+++ b/Zend/tests/oss_fuzz_61712b.phpt
@@ -0,0 +1,20 @@
+--TEST--
+OSS-Fuzz #61712 (assertion failure with error handler during binary op)
+--FILE--
+<?php
+#[AllowDynamicProperties]
+class C {
+    function error($_, $msg) {
+        echo $msg, "\n";
+        $this->a = 12345;
+    }
+}
+
+$c = new C;
+set_error_handler([$c, 'error']);
+$c->a %= 10;
+var_dump($c->a);
+?>
+--EXPECT--
+Undefined property: C::$a
+int(5)
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index 1b38e8e411304..5146b0864916d 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -1163,7 +1163,7 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *nam
 			if (UNEXPECTED(type == BP_VAR_RW || type == BP_VAR_R)) {
 				zend_error(E_WARNING, "Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
 			}
-			retval = zend_hash_update(zobj->properties, name, &EG(uninitialized_zval));
+			retval = zend_hash_add(zobj->properties, name, &EG(uninitialized_zval));
 		}
 	} else if (zobj->ce->__get == NULL) {
 		retval = &EG(error_zval);