[php-src] master: Zend: Restart the va_list per callback in zend_llist_apply_with_arguments()

Author: Ilia Alshanetsky (iliaal) Date: 2026-10-02T05:36:22-04:00 Commit: https://github.com/php/php-src/commit/fc3a76a603eb2e9cd57522da0715b6b99026449f Raw diff: https://github.com/php/php-src/commit/fc3a76a603eb2e9cd57522da0715b6b99026449f.diff Zend: Restart the va_list per callback in zend_llist_apply_with_arguments() zend_llist_apply_with_arguments() passed the same va_list to every callback. Once a callback consumes it with va_arg(), the caller's va_list is indeterminate (C11 7.16p3); where va_list is an array type, as on x86-64 SysV, the next callback reads past the arguments. Through zend_extension_dispatch_message(), the second loaded zend_extension with a message_handler received a garbage message and arg. Closes GH-24044 Changed paths: M Zend/zend_llist.c Diff: diff --git a/Zend/zend_llist.c b/Zend/zend_llist.c index 8c42b2494ea0..d0818acc6a0d 100644 --- a/Zend/zend_llist.c +++ b/Zend/zend_llist.c @@ -243,11 +243,11 @@ ZEND_API void zend_llist_apply_with_arguments(zend_llist *l, llist_apply_with_ar zend_llist_element *element; va_list args; - va_start(args, num_args); for (element=l->head; element; element=element->next) { + va_start(args, num_args); func(element->data, num_args, args); + va_end(args); } - va_end(args); }