[php-src] PR #23233: Fix GH-23232: is_callable('\::method') asks the autoloader for an empty class name
| From: | spawnia | Date: | Wed, 12 Aug 2026 15:15:52 +0000 |
| Subject: | [php-src] PR #23233: Fix GH-23232: is_callable('\::method') asks the autoloader for an empty class name | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37803@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23233
Author: spawnia
Fixes GH-23232.
zend_lookup_class_ex() rejects an empty class name, but not a name consisting solely of
the namespace separator: "\" passes the length check, gets its leading
\ stripped, and is then looked up — and autoloaded — as "".
That is reachable from userland: is_callable('\::method') splits at
::, takes "\" as the class part and hands it to
zend_lookup_class(). is_callable('::method') is rejected as an
invalid function name earlier, which is where the asymmetry in the issue comes from.
A lone \ names no class, so return NULL before consulting the class table
or the autoloader.
This is observable, not just wasted work: Composer's
ClassLoader::findFileWithExtension() does $first = $class[0]; and warns
Uninitialized string offset 0 when handed '', which in
applications that promote warnings to exceptions aborts the request. We hit it in CI through
Laravel's Factory::expandAttributes(), which calls is_callable() on
every string attribute — a randomly generated password starting with \:: was enough.
Targeting PHP-8.4 as the lowest branch still receiving bug fixes.
make test passes on Zend/tests and
ext/standard/tests/general_functions (5085 passed, 0 failed) in a debug build; the new
.phpt fails without the patch.