[GIT-PULLS] [php-src] PR #22881: Fix GH-22878: Use-after-free of callable via autoloader
[email protected] (iliaal) Fri, 24 Jul 2026 18:48:46 +0000
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/22881 Author: iliaal A `['Class','method']` or `'Class::method'` callable is validated by borrowing the method name and object out of the callable, then resolving the class. Resolving a string class can run an autoloader, and a compound name emits a deprecation that reaches a user error handler; either can free or mutate the callable mid-validation, so the borrowed method string and `$this` dangle when the method is resolved and the call frame is built. This copies the borrowed string before the reentrant lookup and holds the array across `INIT_USER_CALL` so the object survives, covering `call_user_func()`, `call_user_func_array()`, `$cb()`, and referenced/reference-wrapped array callables. Fixes #22878