[php-src] PR #25259: Fix GH-25253: JIT reads parent of an unlinked class
| From: | lazerg | Date: | Sat, 07 Nov 2026 01:01:59 +0000 |
| Subject: | [php-src] PR #25259: Fix GH-25253: JIT reads parent of an unlinked class | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40371@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25259
Author: lazerg
zend_get_known_class() follows ce->parent for parent::
without checking ZEND_ACC_LINKED, so for a class whose parent lives in another file it
reads parent_name as a class entry. The check after it rarely saves us: the persisted
string has refcount 2, so type reads as ZEND_USER_CLASS, and once the
interned strings buffer is full the string is copied into the script's own shm, where the word
at info.user.filename can be this script's filename. Then
zend_hash_find() runs on garbage. The fix checks the flag first, like the optimizer
already does. The test uses opcache.interned_strings_buffer=0 to get the same layout
and segfaults without the fix.
Fixes #25253