[php-src] PR #25259: Fix GH-25253: JIT reads parent of an unlinked class

From: Date: Sat, 07 Nov 2026 01:01:59 +0000
Subject: [php-src] PR #25259: Fix GH-25253: JIT reads parent of an unlinked class
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-40371@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/25259 Author: lazerg zend_get_known_class() follows ce->parent for parent:: without checking ZEND_ACC_LINKED, so for a class whose parent lives in another file it reads parent_name as a class entry. The check after it rarely saves us: the persisted string has refcount 2, so type reads as ZEND_USER_CLASS, and once the interned strings buffer is full the string is copied into the script's own shm, where the word at info.user.filename can be this script's filename. Then zend_hash_find() runs on garbage. The fix checks the flag first, like the optimizer already does. The test uses opcache.interned_strings_buffer=0 to get the same layout and segfaults without the fix. Fixes #25253

« previous php.git-pulls (#40371) next »