[GIT-PULLS] [php-src] PR #22978: Check object_init_ex() in ReflectionMethod::createFromMethodName()
[email protected] (iliaal) Fri, 31 Jul 2026 16:04:28 +0000
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/22978
Author: iliaal
`instantiate_reflection_method()` ignores the result of `object_init_ex()`. On an uninstantiable subclass that call throws, sets the return value to NULL and reports FAILURE, and the helper then runs `Z_REFLECTION_P()` over the NULL `zend_object`, offsetting backwards out of the allocation.
```php
class C { public function a() {} }
abstract class R extends ReflectionMethod {}
R::createFromMethodName('C::a');
// SIGSEGV in reflection_prop_name(), php_reflection.c:71
```
Segfaults on 8.4, 8.5 and master; 8.3 carries the same code. `ReflectionClass::newInstance()`, `newInstanceArgs()` and `newInstanceWithoutConstructor()` already test the result the same way. Found while reviewing #22968, which touches the same helper but does not cause this.