[GIT-PULLS] [php-src] PR #22978: Check object_init_ex() in ReflectionMethod::createFromMethodName()

[email protected] (iliaal) Fri, 31 Jul 2026 16:04:28 +0000
Newsgroups php.git-pulls
Message-ID <[email protected]>
Pull Request: https://github.com/php/php-src/pull/22978
Author: iliaal

`instantiate_reflection_method()` ignores the result of `object_init_ex()`. On an uninstantiable subclass that call throws, sets the return value to NULL and reports FAILURE, and the helper then runs `Z_REFLECTION_P()` over the NULL `zend_object`, offsetting backwards out of the allocation.

```php
class C { public function a() {} }
abstract class R extends ReflectionMethod {}
R::createFromMethodName('C::a');
// SIGSEGV in reflection_prop_name(), php_reflection.c:71
```

Segfaults on 8.4, 8.5 and master; 8.3 carries the same code. `ReflectionClass::newInstance()`, `newInstanceArgs()` and `newInstanceWithoutConstructor()` already test the result the same way. Found while reviewing #22968, which touches the same helper but does not cause this.