From 1a28868939e53ec693af786c8051afd5d596d151 Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Mon, 26 Oct 2026 06:06:23 +0500
Subject: [PATCH] Fix GH-24701: Use-after-free on typed trait constants during
 opcache preload

Co-authored-by: sanklamm <4759687+sanklamm@users.noreply.github.com>
---
 NEWS                                  |  2 ++
 Zend/zend_inheritance.c               |  1 +
 ext/opcache/tests/gh24701.phpt        | 21 +++++++++++++++++++++
 ext/opcache/tests/preload_gh24701.inc | 21 +++++++++++++++++++++
 4 files changed, 45 insertions(+)
 create mode 100644 ext/opcache/tests/gh24701.phpt
 create mode 100644 ext/opcache/tests/preload_gh24701.inc

diff --git a/NEWS b/NEWS
index 5ea9ecbafb0b..9203ebaac49d 100644
--- a/NEWS
+++ b/NEWS
@@ -30,6 +30,8 @@ PHP                                                                        NEWS
     for grouping. (Klaas Skelte van der Werf)
   . Fixed bug GH-24265 (Unwind/GracefulExit discarded in
     zend_fiber_execute()). (David Carlier)
+  . Fixed bug GH-24701 (Use-after-free on typed trait constants during
+    opcache preload). (sanklamm, lazerg)
 
 - Date:
   . Fixed bug GH-20503 (Assertion failure with ext/date DateInterval property
diff --git a/Zend/zend_inheritance.c b/Zend/zend_inheritance.c
index a4dd5f1893d5..44c75f58a8b3 100644
--- a/Zend/zend_inheritance.c
+++ b/Zend/zend_inheritance.c
@@ -2848,6 +2848,7 @@ static void zend_do_traits_constant_binding(zend_class_entry *ce, zend_class_ent
 
 				Z_TRY_ADDREF(constant->value);
 				constant->doc_comment = constant->doc_comment ? zend_string_copy(constant->doc_comment) : NULL;
+				zend_type_copy_ctor(&constant->type, /* use_arena */ true, /* persistent */ false);
 				if (constant->attributes && (!(GC_FLAGS(constant->attributes) & IS_ARRAY_IMMUTABLE))) {
 					GC_ADDREF(constant->attributes);
 				}
diff --git a/ext/opcache/tests/gh24701.phpt b/ext/opcache/tests/gh24701.phpt
new file mode 100644
index 000000000000..c3136fb046a9
--- /dev/null
+++ b/ext/opcache/tests/gh24701.phpt
@@ -0,0 +1,21 @@
+--TEST--
+GH-24701 (Use-after-free on typed trait constants during opcache preload)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+opcache.preload={PWD}/preload_gh24701.inc
+--SKIPIF--
+<?php
+if (PHP_OS_FAMILY == 'Windows') die('skip Preloading is not supported on Windows');
+?>
+--FILE--
+<?php
+var_dump(C::x());
+var_dump(C::Y);
+?>
+--EXPECT--
+enum(E::A)
+enum(F::B)
diff --git a/ext/opcache/tests/preload_gh24701.inc b/ext/opcache/tests/preload_gh24701.inc
new file mode 100644
index 000000000000..ebd9039af1f4
--- /dev/null
+++ b/ext/opcache/tests/preload_gh24701.inc
@@ -0,0 +1,21 @@
+<?php
+enum E: string {
+    case A = 'a';
+}
+
+enum F: string {
+    case B = 'b';
+}
+
+trait T {
+    protected const E X = E::A;
+    public const E|F Y = F::B;
+}
+
+class C {
+    use T;
+
+    public static function x() {
+        return self::X;
+    }
+}