Skip to content

Fix GH-25007: PFA named args in constant expression write out of bounds - #25012

Merged
arnaud-lb merged 4 commits into
php:PHP-8.6from
lazerg:fix/gh-25007
Oct 29, 2026
Merged

arnaud-lb merged 4 commits into
php:PHP-8.6from
lazerg:fix/gh-25007

Conversation

@lazerg

@lazerg lazerg commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

In a constant expression, zend_ast_evaluate_arg_list() added every named argument to named_positions, while zend_compile_args_ex() only adds named placeholders. zp_compile() uses those positions to index the params array, which only has room for the placeholders, so f(a: 1, b: ?) wrote past the end of it. Now only named placeholders get a position, same as the compiled path.

Fixes #25007

* up/PHP-8.6:
  Fix json_encode() reporting false "Recursion detected" after OOM for hooked-property objects (php#24992)
  Fix phpGH-25023: ZEND_CONTAINER_OF() fails to compile with -std=c11 (php#25027)
  Fix flaky FPM test for bug #77023 (php#24999)
  Update GitHub Action workflows to `actions/checkout@v7` (8.6)
  Update GitHub Action workflows to `actions/checkout@v7` (8.5)
  Update GitHub Action workflows to `actions/checkout@v7` (8.4)
  Update GitHub Action workflows to `actions/checkout@v7`
  Fix phpGH-23626: OPcache: orphaned temporaries cause leaks and assertions
  [ci skip] Fix comment
  Fix block pass dropping ZEND_FAST_CALL OP2 definition
  Fix phpGH-23572: JIT calls wrong static method from trait clones
  Fix phpGH-24784: Preserve certificates when reading PKCS7/CMS CRLs (php#24785)
@arnaud-lb
arnaud-lb merged commit 0ceaea9 into php:PHP-8.6 Oct 29, 2026
1 of 2 checks passed
arnaud-lb added a commit that referenced this pull request Oct 29, 2026
* PHP-8.6:
  Fix GH-25007: PFA named args in constant expression write out of bounds (#25012)
@arnaud-lb

Copy link
Copy Markdown
Member

Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants