[GIT-PULLS] [php-src] PR #22881: Fix GH-22878: Use-after-free of callable via autoloader

[email protected] (iliaal) Fri, 24 Jul 2026 18:48:46 +0000
Newsgroups php.git-pulls
Message-ID <[email protected]>
Pull Request: https://github.com/php/php-src/pull/22881
Author: iliaal

A `['Class','method']` or `'Class::method'` callable is validated by borrowing the method name and object out of the callable, then resolving the class. Resolving a string class can run an autoloader, and a compound name emits a deprecation that reaches a user error handler; either can free or mutate the callable mid-validation, so the borrowed method string and `$this` dangle when the method is resolved and the call frame is built. This copies the borrowed string before the reentrant lookup and holds the array across `INIT_USER_CALL` so the object survives, covering `call_user_func()`, `call_user_func_array()`, `$cb()`, and referenced/reference-wrapped array callables.

Fixes #22878