[GIT-PULLS] [php-src] PR #23233: Fix GH-23232: is_callable('\::method') asks the autoloader for an empty class name

[email protected] (spawnia)
Newsgroups php.git-pulls
Message-ID <[email protected]>
Pull Request: https://github.com/php/php-src/pull/23233
Author: spawnia

Fixes GH-23232.

`zend_lookup_class_ex()` rejects an empty class name, but not a name consisting solely of the namespace separator: `"\"` passes the length check, gets its leading `\` stripped, and is then looked up — and autoloaded — as `""`.

That is reachable from userland: `is_callable('\::method')` splits at `::`, takes `"\"` as the class part and hands it to `zend_lookup_class()`. `is_callable('::method')` is rejected as an invalid function name earlier, which is where the asymmetry in the issue comes from.

A lone `\` names no class, so return `NULL` before consulting the class table or the autoloader.

This is observable, not just wasted work: Composer's `ClassLoader::findFileWithExtension()` does `$first = $class[0];` and warns `Uninitialized string offset 0` when handed `''`, which in applications that promote warnings to exceptions aborts the request. We hit it in CI through Laravel's `Factory::expandAttributes()`, which calls `is_callable()` on every string attribute — a randomly generated password starting with `\::` was enough.

Targeting `PHP-8.4` as the lowest branch still receiving bug fixes.

`make test` passes on `Zend/tests` and `ext/standard/tests/general_functions` (5085 passed, 0 failed) in a debug build; the new `.phpt` fails without the patch.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.