[php-src] PR #23233: Fix GH-23232: is_callable('\::method') asks the autoloader for an empty class name

From: Date: Wed, 12 Aug 2026 15:15:52 +0000
Subject: [php-src] PR #23233: Fix GH-23232: is_callable('\::method') asks the autoloader for an empty class name
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-37803@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/23233 Author: spawnia Fixes GH-23232. zend_lookup_class_ex() rejects an empty class name, but not a name consisting solely of the namespace separator: "\" passes the length check, gets its leading \ stripped, and is then looked up — and autoloaded — as "". That is reachable from userland: is_callable('\::method') splits at ::, takes "\" as the class part and hands it to zend_lookup_class(). is_callable('::method') is rejected as an invalid function name earlier, which is where the asymmetry in the issue comes from. A lone \ names no class, so return NULL before consulting the class table or the autoloader. This is observable, not just wasted work: Composer's ClassLoader::findFileWithExtension() does $first = $class[0]; and warns Uninitialized string offset 0 when handed '', which in applications that promote warnings to exceptions aborts the request. We hit it in CI through Laravel's Factory::expandAttributes(), which calls is_callable() on every string attribute — a randomly generated password starting with \:: was enough. Targeting PHP-8.4 as the lowest branch still receiving bug fixes. make test passes on Zend/tests and ext/standard/tests/general_functions (5085 passed, 0 failed) in a debug build; the new .phpt fails without the patch.

« previous php.git-pulls (#37803) next »