[GIT-PULLS] [php-src] PR #22688: Fix callable invalidation during autoloading

[email protected] (PuH4ck3rX)
Newsgroups php.git-pulls
Message-ID <[email protected]>
Pull Request: https://github.com/php/php-src/pull/22688
Author: PuH4ck3rX

Autoloading can execute user code while a callable is being resolved. The dynamic-call helpers and the common callable resolver kept borrowed pointers into the original callable across that boundary. If the autoloader modified or released the callable, the subsequent method lookup could read freed or retyped values.

This change snapshots the relevant class and method strings before class lookup can invoke autoloading. For direct Class::method dynamic calls, the method name is also extracted before entering the autoloader. The same lifetime rule is applied to zend_is_callable_at_frame(), covering both array and string callables used by APIs such as is_callable() and call_user_func().

The regression tests use deterministic callable mutation during autoloading and verify that the callable value captured at the start of resolution is used for the current call.

Checks performed:

- Built PHP 8.4 with ASan and UBSan, with opcache JIT disabled.
- 3 new PHPT tests passed.
- 33 related dynamic-call, callable, is_callable(), and call_user_func() tests passed.
- 5 reduced reproducer scripts completed without sanitizer findings.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.