[php-src] PR #24580: Fix GH-24579: Crash in FILTER_VALIDATE_INT when __toString() mutates the options

From: Date: Thu, 22 Oct 2026 21:36:28 +0000
Subject: [php-src] PR #24580: Fix GH-24579: Crash in FILTER_VALIDATE_INT when __toString() mutates the options
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-39740@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24580 Author: bercedev Fixes #24579 php_filter_call() kept options pointing at the zval inside the filter args (through the reference in the repro). For an object value, php_zval_filter() converts it to a string first, which runs __toString(); reassigning the referenced options there frees the array, and the filter then reads it (FETCH_LONG_OPTION on what is now a string). The call now holds its own counted copy of the options zval and releases it on every exit, so the filter sees the options as they were when it was called. Added ext/filter/tests/gh24579.phpt with the repro from the issue: it fails on PHP-8.4 (debug build aborts with the inconsistent hash table assertion) and passes with this. All ext/filter/tests pass on a debug build.

« previous php.git-pulls (#39740) next »