[php-src] PR #24710: Fix GH-24701: Use-after-free on typed trait constants during opcache preload

From: Date: Mon, 26 Oct 2026 01:06:39 +0000
Subject: [php-src] PR #24710: Fix GH-24701: Use-after-free on typed trait constants during opcache preload
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-39886@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24710 Author: lazerg zend_do_traits_constant_binding() copies the trait constant into the using class but doesn't take a reference on its type, so both constants share the same class name string. During preload that string isn't interned yet, and when opcache interns it for the first constant it frees the original while the second still points to it. Now the copy goes through zend_type_copy_ctor(), same as the trait property path. A union type also shared the type list, which trips an assertion in debug builds, so the test covers both. Based on the reporter's suggested fix. Fixes #24701

« previous php.git-pulls (#39886) next »