[php-src] PR #24788: Fix GH-20403: Backport FETCH_OBJ_UNSET IS_UNDEF fix to PHP-8.4
| From: | Truta446 | Date: | Tue, 27 Oct 2026 14:50:10 +0000 |
| Subject: | [php-src] PR #24788: Fix GH-20403: Backport FETCH_OBJ_UNSET IS_UNDEF fix to PHP-8.4 | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39973@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24788
Author: Truta446
> GH-20403 still reproduces on PHP-8.4 and PHP-8.5:
>
unset($test::$instances[$x]->x) on an uninitialized typed static
> property reaches the IS_UNDEF container branch of
> zend_fetch_dimension_address() with a VAR operand, and
> zval_undefined_cv() reads past the CV names (heap-buffer-overflow
> under ASan, reproducer from @arnaud-lb in the issue).
>
> As noted in the issue, this is already fixed on master/PHP-8.6 by 8b4ef3a09f (GH-19160,
> "Fix FETCH_OBJ_UNSET IS_UNDEF result"), which was only merged into master. This PR
> backports it to PHP-8.4.
>
> - Commit 1 is a cherry-pick of 8b4ef3a09f (authorship kept). It needed one adaptation: on
> PHP-8.4 zend_fetch_static_property_address_ex() returns
> zend_result, so the new early return is return
> FAILURE; instead of return NULL;. The two callers
> that can pass BP_VAR_IS/BP_VAR_UNSET
> (zend_fetch_static_prop_helper and
> ZEND_ISSET_ISEMPTY_STATIC_PROP) already treat
> FAILURE the same way master treats
> NULL. Zend/zend_vm_execute.h was
> regenerated with zend_vm_gen.php. NEWS left out.
> - Commit 2 adds Zend/tests/gh20403.phpt.
>
> Verification:
> - gh20403.phpt fails under
> --asan on an unpatched PHP-8.5 build and passes with this patch.
> - PHP-8.4 debug + ASan: Zend/tests and
> tests/lang (5281 passed, 0 failed);
> Zend/tests and ext/opcache/tests
> with opcache.enable_cli=1,
> opcache.jit=tracing,
> opcache.protect_memory=1 (5301 passed, 0 failed).
> - PHP-8.4 debug ZTS: Zend/tests (5019 passed, 0 failed).
>
> If you would rather keep this master-only, feel free to close; the test may still be useful
> there.