From 44b9cb0fdf615e2aff64205d6a1ca198c4a89645 Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Wed, 28 Oct 2026 21:46:46 +0500
Subject: [PATCH 1/3] Fix GH-25007: PFA named args in constant expression write
 out of bounds

---
 Zend/tests/partial_application/gh25007.phpt | 31 +++++++++++++++++++++
 Zend/zend_ast.c                             | 16 +++++------
 2 files changed, 39 insertions(+), 8 deletions(-)
 create mode 100644 Zend/tests/partial_application/gh25007.phpt

diff --git a/Zend/tests/partial_application/gh25007.phpt b/Zend/tests/partial_application/gh25007.phpt
new file mode 100644
index 000000000000..99899a615778
--- /dev/null
+++ b/Zend/tests/partial_application/gh25007.phpt
@@ -0,0 +1,31 @@
+--TEST--
+GH-25007 (PFA in constexpr: named args before a named placeholder)
+--FILE--
+<?php
+
+function f($a, $b = 2, $c = 3) {
+    var_dump(func_get_args());
+}
+
+const C1 = f(a: 1, b: ?);
+const C2 = f(a: 1, c: ?, b: ?);
+
+(C1)(4);
+(C2)(5, 6);
+
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(4)
+}
+array(3) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(6)
+  [2]=>
+  int(5)
+}
diff --git a/Zend/zend_ast.c b/Zend/zend_ast.c
index e6b7dd32e28c..e55a90001d2d 100644
--- a/Zend/zend_ast.c
+++ b/Zend/zend_ast.c
@@ -701,14 +701,6 @@ static zend_execute_data *zend_ast_evaluate_arg_list(
 			if (!arg) {
 				goto fail;
 			}
-			if (named_positions_ptr) {
-				if (!*named_positions_ptr) {
-					*named_positions_ptr = zend_new_array(0);
-				}
-				zval tmp;
-				ZVAL_LONG(&tmp, zend_hash_num_elements(*named_positions_ptr));
-				zend_hash_add(*named_positions_ptr, arg_name, &tmp);
-			}
 			arg_ast = arg_ast->child[1];
 		} else {
 			arg = ZEND_CALL_VAR_NUM(frame, ZEND_CALL_NUM_ARGS(frame));
@@ -724,6 +716,14 @@ static zend_execute_data *zend_ast_evaluate_arg_list(
 			} else {
 				Z_TYPE_INFO_P(arg) = _IS_PLACEHOLDER;
 			}
+			if (arg_name && named_positions_ptr) {
+				if (!*named_positions_ptr) {
+					*named_positions_ptr = zend_new_array(0);
+				}
+				zval tmp;
+				ZVAL_LONG(&tmp, zend_hash_num_elements(*named_positions_ptr));
+				zend_hash_add(*named_positions_ptr, arg_name, &tmp);
+			}
 		} else {
 			if (zend_ast_evaluate_ex(arg, arg_ast, scope, short_circuited_ptr, ctx) == FAILURE) {
 				ZVAL_UNDEF(arg);

From cec3763fa565da11e4c3794b23446c6a555904a3 Mon Sep 17 00:00:00 2001
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
Date: Thu, 29 Oct 2026 10:53:30 +0100
Subject: [PATCH 2/3] [ci skip] NEWS

---
 NEWS | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/NEWS b/NEWS
index cdb7d5e33367..4af650198c1d 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,8 @@ PHP                                                                        NEWS
     for grouping. (Klaas Skelte van der Werf)
   . Fixed unmapping of an unrelated range when the aligned chunk mmap fails
     (Marti2203).
+  . Fixed bug GH-25007 (Partial function application: named args in a constant
+    expression cause out-of-bounds write in zp_compile()). (lazerg)
 
 - CLI:
   . Fixed bug GH-24697 (PHP_HTTP_PARSER_STRICT build option doesn't work).

From 197ebb8b01846565fcaee3ee7b5f20c0da501649 Mon Sep 17 00:00:00 2001
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
Date: Thu, 29 Oct 2026 10:56:53 +0100
Subject: [PATCH 3/3] [ci skip] NEWS

---
 NEWS | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/NEWS b/NEWS
index b5285b5441a8..8929fa19c5e9 100644
--- a/NEWS
+++ b/NEWS
@@ -7,10 +7,10 @@ PHP                                                                        NEWS
     for grouping. (Klaas Skelte van der Werf)
   . Fixed unmapping of an unrelated range when the aligned chunk mmap fails
     (Marti2203).
-  . Fixed bug GH-25007 (Partial function application: named args in a constant
-    expression cause out-of-bounds write in zp_compile()). (lazerg)
   . Fixed bug GH-25023 (ZEND_CONTAINER_OF() fails to compile with -std=c11).
     (lazerg)
+  . Fixed bug GH-25007 (Partial function application: named args in a constant
+    expression cause out-of-bounds write in zp_compile()). (lazerg)
 
 - CLI:
   . Fixed bug GH-24697 (PHP_HTTP_PARSER_STRICT build option doesn't work).