[php-src] PR #23095: Zend: include() with a non-literal argument reads out of bounds with …
| From: | devnexen | Date: | Thu, 06 Aug 2026 20:11:09 +0000 |
| Subject: | [php-src] PR #23095: Zend: include() with a non-literal argument reads out of bounds with … | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37592@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23095
Author: devnexen
…error_include_args=1.
Fix #23083
RT_CONSTANT() is only valid when op1 is a literal, so a CV or TMP operand turned a frame offset into
a pointer inside the opline array. Read the operand from the call frame instead unless op1_type is
IS_CONST.