[php-src] PR #22978: Check object_init_ex() in ReflectionMethod::createFromMethodName()
| From: | iliaal | Date: | Fri, 31 Jul 2026 16:04:28 +0000 |
| Subject: | [php-src] PR #22978: Check object_init_ex() in ReflectionMethod::createFromMethodName() | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37421@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/22978
Author: iliaal
instantiate_reflection_method() ignores the result of object_init_ex(). On
an uninstantiable subclass that call throws, sets the return value to NULL and reports FAILURE, and
the helper then runs Z_REFLECTION_P() over the NULL zend_object,
offsetting backwards out of the allocation.
```php
class C { public function a() {} }
abstract class R extends ReflectionMethod {}
R::createFromMethodName('C::a');
// SIGSEGV in reflection_prop_name(), php_reflection.c:71
```
Segfaults on 8.4, 8.5 and master; 8.3 carries the same code.
ReflectionClass::newInstance(), newInstanceArgs() and
newInstanceWithoutConstructor() already test the result the same way. Found while
reviewing #22968, which touches the same helper but does not cause this.