[php-src] PHP-8.5: Fix GH-24523: UAF in zend_test_compile_to_ast() on parse error (#24524)

Author: Lazizbek Ergashev (lazerg) Committer: GitHub (web-flow) Pusher: ndossche Date: 2026-10-22T15:06:18+02:00 Commit: https://github.com/php/php-src/commit/81dfb44d195be4b6e2a665a4e5bd5f2a394ca990 Raw diff: https://github.com/php/php-src/commit/81dfb44d195be4b6e2a665a4e5bd5f2a394ca990.diff Fix GH-24523: UAF in zend_test_compile_to_ast() on parse error (#24524) Changed paths: A ext/zend_test/tests/gh24523.phpt M ext/zend_test/test.c Diff: diff --git a/ext/zend_test/test.c b/ext/zend_test/test.c index 400a2413a8ae..355e76289a07 100644 --- a/ext/zend_test/test.c +++ b/ext/zend_test/test.c @@ -1976,6 +1976,9 @@ static PHP_FUNCTION(zend_test_compile_to_ast) zend_arena *ast_arena; zend_ast *ast = zend_compile_string_to_ast(str, &ast_arena, ZSTR_EMPTY_ALLOC()); + if (!ast) { + RETURN_THROWS(); + } zend_string *result = zend_ast_export("", ast, ""); diff --git a/ext/zend_test/tests/gh24523.phpt b/ext/zend_test/tests/gh24523.phpt new file mode 100644 index 000000000000..633e88baec17 --- /dev/null +++ b/ext/zend_test/tests/gh24523.phpt @@ -0,0 +1,16 @@ +--TEST-- +GH-24523 (UAF in zend_test_compile_to_ast() on parse error) +--EXTENSIONS-- +zend_test +--FILE-- +<?php + +try { + zend_test_compile_to_ast("<?php ("); +} catch (ParseError $e) { + echo $e->getMessage(), "\n"; +} + +?> +--EXPECT-- +Unclosed '('