Re: [PHP-DEV] Categorising engine bugs caused by nonsensical/malicious callback handlers as Undefined Behaviour and to not fix them

On Tue, Sep 8, 2026 at 9:08 AM Ilija Tovilo <[email protected]> wrote:

> > As such I'd like to hear the opinions of Internals on if we can come to
> a consensus (ideally without an RFC...) that registering callbacks that
> mess around with state in non-intended ways is Undefined Behaviour (UB).
>
> I'd still very much be in favor of fixing these issues, mainly because
> they are a big time sink for the security team as well, due to
> false-positive reports. Arnaud and I were planning on proposing an RFC
> that mitigates at least a large portion of them, before we got occupied
> with other things.
>

That is absolutely the ideal fix for this class of issues.


>
> I absolutely do not think each case should be considered individually,
> because we already tried this and the issues never stop coming.
>

True, but UB exists outside that class and those issues are worth the
attention imho.


-- 
Ilia Alshanetsky
Technologist, CTO, Entrepreneur
E: [email protected]
T: @iliaa
B: http://ilia.ws