[php-src] master: Fix use-of-uninitialized-value ast->lineno

Author: Ilija Tovilo (iluuu1994)
Date: 2026-07-26T18:14:33+02:00

Commit: https://github.com/php/php-src/commit/7ad79be6550fba20df3d7cea0a5d9da79861c1f9
Raw diff: https://github.com/php/php-src/commit/7ad79be6550fba20df3d7cea0a5d9da79861c1f9.diff

Fix use-of-uninitialized-value ast->lineno

Exposed after GH-22833. ast->kind in this context may refer to a ZEND_AST_ZVAL,
for which accessing lineno is incorrect. lineno is stored in zval.u2 instead.

Fixes OSS-Fuzz-539121135

Changed paths:
  A  Zend/tests/oss-fuzz-539121135.phpt
  M  Zend/zend_compile.c


Diff:

diff --git a/Zend/tests/oss-fuzz-539121135.phpt b/Zend/tests/oss-fuzz-539121135.phpt
new file mode 100644
index 000000000000..bf44d659cd7b
--- /dev/null
+++ b/Zend/tests/oss-fuzz-539121135.phpt
@@ -0,0 +1,12 @@
+--TEST--
+OSS-Fuzz-539121135: Use-of-uninitialized-value ast->lineno
+--FILE--
+<?php
+
+namespace {}
+
+''
+
+?>
+--EXPECTF--
+Fatal error: No code may exist outside of namespace {} in %s on line %d
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 450b192ac482..2466710f9cee 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -12215,7 +12215,7 @@ static void zend_compile_stmt(zend_ast *ast) /* {{{ */
 		return;
 	}
 
-	CG(zend_lineno) = ast->lineno;
+	CG(zend_lineno) = zend_ast_get_lineno(ast);
 
 	if ((CG(compiler_options) & ZEND_COMPILE_EXTENDED_STMT) && !zend_is_unticked_stmt(ast)) {
 		zend_do_extended_stmt(NULL);