[GIT-PULLS] [php-src] PR #23233: Fix GH-23232: is_callable('\::method') asks the autoloader for an empty class name
[email protected] (spawnia)
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/23233
Author: spawnia
Fixes GH-23232.
`zend_lookup_class_ex()` rejects an empty class name, but not a name consisting solely of the namespace separator: `"\"` passes the length check, gets its leading `\` stripped, and is then looked up — and autoloaded — as `""`.
That is reachable from userland: `is_callable('\::method')` splits at `::`, takes `"\"` as the class part and hands it to `zend_lookup_class()`. `is_callable('::method')` is rejected as an invalid function name earlier, which is where the asymmetry in the issue comes from.
A lone `\` names no class, so return `NULL` before consulting the class table or the autoloader.
This is observable, not just wasted work: Composer's `ClassLoader::findFileWithExtension()` does `$first = $class[0];` and warns `Uninitialized string offset 0` when handed `''`, which in applications that promote warnings to exceptions aborts the request. We hit it in CI through Laravel's `Factory::expandAttributes()`, which calls `is_callable()` on every string attribute — a randomly generated password starting with `\::` was enough.
Targeting `PHP-8.4` as the lowest branch still receiving bug fixes.
`make test` passes on `Zend/tests` and `ext/standard/tests/general_functions` (5085 passed, 0 failed) in a debug build; the new `.phpt` fails without the patch.