Skip to content

Fix GH-24701: Use-after-free on typed trait constants during opcache preload - #24710

Open
lazerg wants to merge 1 commit into
php:PHP-8.4from
lazerg:fix/gh-24701-trait-const-type
Open

lazerg wants to merge 1 commit into
php:PHP-8.4from
lazerg:fix/gh-24701-trait-const-type

Conversation

@lazerg

@lazerg lazerg commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

zend_do_traits_constant_binding() copies the trait constant into the using class but doesn't take a reference on its type, so both constants share the same class name string. During preload that string isn't interned yet, and when opcache interns it for the first constant it frees the original while the second still points to it. Now the copy goes through zend_type_copy_ctor(), same as the trait property path. A union type also shared the type list, which trips an assertion in debug builds, so the test covers both.

Based on the reporter's suggested fix.

Fixes #24701

…he preload

Co-authored-by: sanklamm <4759687+sanklamm@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant