Skip to content

Fix callable invalidation during autoloading#22688

Open
PuH4ck3rX wants to merge 1 commit into
php:PHP-8.4from
PuH4ck3rX:agent/fix-callable-autoload-uaf
Open

Fix callable invalidation during autoloading#22688
PuH4ck3rX wants to merge 1 commit into
php:PHP-8.4from
PuH4ck3rX:agent/fix-callable-autoload-uaf

Conversation

@PuH4ck3rX

Copy link
Copy Markdown

Autoloading can execute user code while a callable is being resolved. The dynamic-call helpers and the common callable resolver kept borrowed pointers into the original callable across that boundary. If the autoloader modified or released the callable, the subsequent method lookup could read freed or retyped values.

This change snapshots the relevant class and method strings before class lookup can invoke autoloading. For direct Class::method dynamic calls, the method name is also extracted before entering the autoloader. The same lifetime rule is applied to zend_is_callable_at_frame(), covering both array and string callables used by APIs such as is_callable() and call_user_func().

The regression tests use deterministic callable mutation during autoloading and verify that the callable value captured at the start of resolution is used for the current call.

Checks performed:

  • Built PHP 8.4 with ASan and UBSan, with opcache JIT disabled.
  • 3 new PHPT tests passed.
  • 33 related dynamic-call, callable, is_callable(), and call_user_func() tests passed.
  • 5 reduced reproducer scripts completed without sanitizer findings.

@PuH4ck3rX PuH4ck3rX marked this pull request as ready for review July 11, 2026 02:54
@PuH4ck3rX PuH4ck3rX requested a review from dstogov as a code owner July 11, 2026 02:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant