[PHP-CVS] [php-src] master: Check object_init_ex() in ReflectionMethod::createFromMethodName()

Author: Ilia Alshanetsky (iliaal)
Date: 2026-07-31T13:28:44-04:00

Commit: https://github.com/php/php-src/commit/b80ef095ea6f02ad823714fe1cc067cda593c812
Raw diff: https://github.com/php/php-src/commit/b80ef095ea6f02ad823714fe1cc067cda593c812.diff

Check object_init_ex() in ReflectionMethod::createFromMethodName()

The result was ignored, so calling the factory on an uninstantiable
subclass ran on a NULL zend_object: object_init_ex() throws, sets the
return value to NULL and reports FAILURE, and Z_REFLECTION_P() then
offsets backwards from that NULL. Other object_init_ex() calls in this
file already test the result.

Closes GH-22978

Changed paths:
  A  ext/reflection/tests/ReflectionMethod_createFromMethodName_abstract.phpt
  M  ext/reflection/php_reflection.c


Diff:

diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index 9f2ca58c56b5..f153cf83e14a 100644
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -3401,7 +3401,10 @@ static void instantiate_reflection_method(INTERNAL_FUNCTION_PARAMETERS, bool is_
 	if (is_constructor) {
 		object = ZEND_THIS;
 	} else {
-		object_init_ex(return_value, execute_data->This.value.ce ? execute_data->This.value.ce : reflection_method_ptr);
+		zend_class_entry *called_ce = execute_data->This.value.ce ? execute_data->This.value.ce : reflection_method_ptr;
+		if (UNEXPECTED(object_init_ex(return_value, called_ce) != SUCCESS)) {
+			RETURN_THROWS();
+		}
 		object = return_value;
 	}
 	intern = Z_REFLECTION_P(object);
diff --git a/ext/reflection/tests/ReflectionMethod_createFromMethodName_abstract.phpt b/ext/reflection/tests/ReflectionMethod_createFromMethodName_abstract.phpt
new file mode 100644
index 000000000000..c77623176fd4
--- /dev/null
+++ b/ext/reflection/tests/ReflectionMethod_createFromMethodName_abstract.phpt
@@ -0,0 +1,23 @@
+--TEST--
+ReflectionMethod::createFromMethodName() called on an abstract subclass
+--FILE--
+<?php
+
+class C {
+    public function a() {}
+}
+
+abstract class R extends ReflectionMethod {}
+
+try {
+    R::createFromMethodName('C::a');
+} catch (Throwable $e) {
+    echo $e::class, ": ", $e->getMessage(), PHP_EOL;
+}
+
+var_dump(ReflectionMethod::createFromMethodName('C::a')->name);
+
+?>
+--EXPECT--
+Error: Cannot instantiate abstract class R
+string(1) "a"