[GIT-PULLS] [php-src] PR #22688: Fix callable invalidation during autoloading
[email protected] (PuH4ck3rX)
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/22688 Author: PuH4ck3rX Autoloading can execute user code while a callable is being resolved. The dynamic-call helpers and the common callable resolver kept borrowed pointers into the original callable across that boundary. If the autoloader modified or released the callable, the subsequent method lookup could read freed or retyped values. This change snapshots the relevant class and method strings before class lookup can invoke autoloading. For direct Class::method dynamic calls, the method name is also extracted before entering the autoloader. The same lifetime rule is applied to zend_is_callable_at_frame(), covering both array and string callables used by APIs such as is_callable() and call_user_func(). The regression tests use deterministic callable mutation during autoloading and verify that the callable value captured at the start of resolution is used for the current call. Checks performed: - Built PHP 8.4 with ASan and UBSan, with opcache JIT disabled. - 3 new PHPT tests passed. - 33 related dynamic-call, callable, is_callable(), and call_user_func() tests passed. - 5 reduced reproducer scripts completed without sanitizer findings.