[php-src] PR #25302: Fix use-after-free in zend_compile_const_decl() under opcache

From: Date: Sun, 08 Nov 2026 04:32:28 +0000
Subject: [php-src] PR #25302: Fix use-after-free in zend_compile_const_decl() under opcache
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-40420@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/25302 Author: nicolas-grekas zend_compile_const_decl() interns the name of the constant, hands it to the literal of ZEND_DECLARE_CONST, then registers it as a seen symbol. With opcache, interning at runtime only finds strings already in shared memory: when the first call misses and another thread or process caches a script holding the same name before the literal interns it again, the literal swaps in the shared string and releases the original, which zend_register_seen_symbol() then reads and addrefs. Registering the symbol first keeps the name referenced while the literal does that. Found with FrankenPHP: restarting its workers makes them compile the same files concurrently on a fresh SHM. ASAN: ``` heap-use-after-free in zend_register_seen_symbol zend_compile.c:433, from zend_compile_const_decl :9484 freed by zend_string_release <- accel_new_interned_string_for_php <- zval_make_interned_string <- zend_insert_literal <- zend_emit_op <- zend_compile_const_decl :9482 ``` No test: this is a race between threads.

« previous php.git-pulls (#40420) next »