[php-src] master: Merge branch 'PHP-8.5' into PHP-8.6

Author: ndossche (ndossche) Date: 2026-10-22T15:06:50+02:00 Commit: https://github.com/php/php-src/commit/11bbfc00228d7d8978e60c35c916d0afbb1ae980 Raw diff: https://github.com/php/php-src/commit/11bbfc00228d7d8978e60c35c916d0afbb1ae980.diff Merge branch 'PHP-8.5' into PHP-8.6 * PHP-8.5: Fix GH-24523: UAF in zend_test_compile_to_ast() on parse error (#24524) Changed paths: A ext/zend_test/tests/gh24523.phpt M ext/zend_test/test.c Diff: diff --git a/ext/zend_test/test.c b/ext/zend_test/test.c index 4867f2f41c69..0658f6a3cf43 100644 --- a/ext/zend_test/test.c +++ b/ext/zend_test/test.c @@ -2663,6 +2663,9 @@ static PHP_FUNCTION(zend_test_compile_to_ast) zend_arena *ast_arena; zend_ast *ast = zend_compile_string_to_ast(str, &ast_arena, ZSTR_EMPTY_ALLOC()); + if (!ast) { + RETURN_THROWS(); + } zend_string *result = zend_ast_export("", ast, ""); diff --git a/ext/zend_test/tests/gh24523.phpt b/ext/zend_test/tests/gh24523.phpt new file mode 100644 index 000000000000..633e88baec17 --- /dev/null +++ b/ext/zend_test/tests/gh24523.phpt @@ -0,0 +1,16 @@ +--TEST-- +GH-24523 (UAF in zend_test_compile_to_ast() on parse error) +--EXTENSIONS-- +zend_test +--FILE-- +<?php + +try { + zend_test_compile_to_ast("<?php ("); +} catch (ParseError $e) { + echo $e->getMessage(), "\n"; +} + +?> +--EXPECT-- +Unclosed '('