[GIT-PULLS] [php-src] PR #23095: Zend: include() with a non-literal argument reads out of bounds with …

[email protected] (devnexen)
Newsgroups php.git-pulls
Message-ID <brPFDCQ8Yi0hW6NBO4qlKnU5yvk5ZsVr6tSgXe3uatU@main.internal.php.net> 
Pull Request: https://github.com/php/php-src/pull/23095
Author: devnexen

…error_include_args=1.

Fix #23083

RT_CONSTANT() is only valid when op1 is a literal, so a CV or TMP operand turned a frame offset into a pointer inside the opline array. Read the operand from the call frame instead unless op1_type is IS_CONST.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.