[php-src] PR #24580: Fix GH-24579: Crash in FILTER_VALIDATE_INT when __toString() mutates the options
| From: | bercedev | Date: | Thu, 22 Oct 2026 21:36:28 +0000 |
| Subject: | [php-src] PR #24580: Fix GH-24579: Crash in FILTER_VALIDATE_INT when __toString() mutates the options | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39740@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24580
Author: bercedev
Fixes #24579
php_filter_call() kept options pointing at the zval inside the filter args
(through the reference in the repro). For an object value, php_zval_filter() converts
it to a string first, which runs __toString(); reassigning the referenced options there
frees the array, and the filter then reads it (FETCH_LONG_OPTION on what is now a
string). The call now holds its own counted copy of the options zval and releases it on every exit,
so the filter sees the options as they were when it was called.
Added ext/filter/tests/gh24579.phpt with the repro from the issue: it fails on PHP-8.4
(debug build aborts with the inconsistent hash table assertion) and passes with this. All
ext/filter/tests pass on a debug build.