[php-src] PR #24619: Fix GH-24579: Validate option_array type before accessing as hash table
| From: | paezraphael | Date: | Fri, 23 Oct 2026 18:31:04 +0000 |
| Subject: | [php-src] PR #24619: Fix GH-24579: Validate option_array type before accessing as hash table | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39783@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24619
Author: paezraphael
Calling filter_var() with FILTER_VALIDATE_INT crashed when the input object implemented __toString()
and modified the options array referenced by the filter arguments during string conversion.
The FETCH_*_OPTION macros checked if option_array was non-null but did not validate it was an array
before using Z_ARRVAL_P(). When __toString() mutated the reference to a string, the code attempted
to access it as a hash table, causing a crash (SIGSEGV in non-debug builds, assertion failure in
debug builds).
This commit adds a Z_TYPE_P(option_array) == IS_ARRAY check to FETCH_LONG_OPTION,
FETCH_DOUBLE_OPTION, and FETCH_STRING_OPTION to ensure the type is an array before accessing as a
hash table.
Added regression test GH-24579.
Fixes GH-24579.
Generated with [Devin](https://devin.ai)