- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Jakub Zelenka <bukka@php.net>
Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
* Zend: always populate error pointer on failure
Most of the code base expects an error to be set if a char* is provided, as this used to be always the case. It no longer was the case since the partially supported callables were deprecates as the deprecation could be promoted to an exception in which case we skipped allocating a char*.
The simple fix, allocate a char* even in case of an exception so callers don't need to check if it still NULL. This fixes some error messages at the same time.
* tree: simplify error handling for failed zend_is_callable() calls
* docs: clarify docs for zend_is_callable()
---------
Co-authored-by: Arnaud Le Blanc <365207+arnaud-lb@users.noreply.github.com>
Since GH-21699, zend_is_callable_check_class() returns false without
setting error when the error handler throws on the self/parent/static
deprecation. zend_call_function() asserted that a failed callable check
always comes with an error message, so calling such a string callback
through call_user_function() (here unserialize_callback_func=parent::...)
aborts on debug builds.
When the check fails with no error, the exception from the handler is
already pending, so zend_call_function() now returns early without
throwing a second one, the same way it does when it is entered with an
exception.
Close GH-23903
Two early returns in zend_call_function() skip
zend_release_fcall_info_cache(): the one taken when zend_deprecated_function()
leaves an exception pending, and the one taken when zend_handle_undef_args()
fails. Both leak the trampoline, so a #[\Deprecated] __call() whose
deprecation is promoted to an exception, and a missing required argument on
Closure::__invoke(), each leak 256 bytes per call and trip the
EG(trampoline) assertion in shutdown_executor() on a debug build.
Closes GH-23831
zend_call_function() ran the callback with fci_cache->object as $this
without holding a reference, so a callback that released the last
reference to its own receiver (an autoloader unregistering itself, a
SQLite3 authorizer calling setAuthorizer(null)) freed $this while its
frame was still executing. Take the reference where the receiver is
selected rather than after argument setup, so the error handlers
reachable from the deprecation notice and the by-reference warning
cannot free it first, and release it on every early exit.
Fixes GH-22060
Fixes GH-22122
A call stack whose depth oscillates across a VM stack page boundary
allocates and frees a 256KB page on every oscillation:
zend_vm_stack_extend() on the way down, and the immediate efree() in
zend_vm_stack_free_call_frame_ex() on the way back. Every such
allocation goes through zend_mm_alloc_large(), whose search for
contiguous free pages degrades on a large, fragmented heap - in the
worst case scanning every chunk's free-page bitmap, failing, and paying
an mmap/munmap round-trip per oscillation.
Long-running processes with multi-GB heaps hit this hard. Profiling
PHPStan analysing a large codebase in a single process showed 73-90% of
all CPU time in zend_mm_alloc_pages reached from the
ZEND_INIT_METHOD_CALL handlers, i.e. pure VM stack page churn. An
isolated reproducer (recursion to a fixed depth in a loop, heap
pre-fragmented with interleaved small allocations) runs 15-22x slower
than on a fresh heap.
Keep up to 32 freed standard-size pages in a per-executor free list and
serve zend_vm_stack_new_page() from it; flush the list in
zend_vm_stack_destroy(). Oversized pages (frames larger than the page
size) are still freed eagerly. With the cache, the fragmented-heap
reproducer matches the fresh-heap numbers at every depth, and deep
recursion on a fresh heap improves as well (331.7 -> 229.6us per
oscillation at depth 9000), since even a fast allocator round-trip is
slower than popping a cached page.
Benchmark and reproducer:
https://gist.github.com/ondrejmirtes/1c1bc4894e63ddcb6c58d7bfe59cdb7a
Co-authored-by: Arnaud Le Blanc <arnaud.lb@gmail.com>
A class name consisting solely of the namespace separator passed the
length check in zend_lookup_class_ex(), lost its leading backslash and
was then looked up and autoloaded as an empty string. This affected all
entry points using that lookup, e.g. is_callable('\::method') and
class_exists('\').
RFC: https://wiki.php.net/rfc/closure-optimizations#stateless_closure_caching
Extracted from GH-19941. Sadly, @DanielEScherzer discovered an edge-case I did
not consider:
class Foo {
public function instanceCall() {
return $this;
}
public function test($c) {
return array_map($c, [1]);
}
}
$foo = new Foo();
var_dump($foo->test('Foo::instanceCall'));
Here, the internal function array_map() can perform instance calls through a
previous stack frame with just a named closure. Same with ['Foo',
'instanceCall']. That's quite esoteric, but this behavior should first be
deprecated and removed before assuming it isn't being used.
For the time being, merge only the latter half of the RFC. Code with all
relevant functions properly annotated as static will get the full performance
benefit.
Closes GH-23203
zend_call_function invokes an internal callee's handler directly, with no
VM frame and without the stack-limit check the interpreter runs at its call
opcodes. An internal function that recurses through zend_call_function, such
as a self- or mutually-attached SPL iterator, never yields back to the VM,
so nothing bounds the recursion and the C stack overflows into a SEGV.
Check zend_call_stack_overflowed() before pushing the call frame and raise
the usual "Maximum call stack size reached" error on overflow. Running the
check ahead of the frame setup keeps the error path free of teardown.
Fixes GH-15672
Fixes GH-15911
Functions that use zend_forbid_dynamic_call() must be flagged with
ZEND_ACC2_FORBID_DYN_CALLS. In stubs, this is done by using
@forbid-dynamic-calls.
To ensure consistency, we assert that the flag exists in
zend_forbid_dynamic_call(), and we assert that flagged functions thrown after a
dynamic call.
Closes GH-21818
There are several issues with this macro:
- It is incorrectly named: It's not an empty default case. It's an unreachable
default case.
- It is hiding control flow in its definition, which can be confusing for
humans and tools (such as Coccinelle) alike, because it looks like it would
be a statement that belongs to the "current" case rather than opening a new
one.
Since this macro is exactly as long as explicitly spelling out its definition
(excluding the useless `break;`), it is not even making the code any more
succinct.
Replace separate num_errors/errors fields with a single struct containing
size, capacity, and a flexible array. The buffer grows by 50% when needed
instead of reallocating on every recorded error.
* zend_globals: Embed `in_autoload` into `zend_executor_globals`
Nowadays virtually any PHP application is making use of autoloading, making the
lazy allocation of the `HashTable` struct a needless pointer indirection.
* zend_globals: Rename `in_autoload` to `autoload_current_classnames`
The old name `in_autoload` was somewhat misleading by implying a `bool`ean
value rather than a `HashTable`. Since the previous change to embed the
`HashTable` is breaking anyway, we can also rename it.
* UPGRADING.INTERNALS
These are leftovers from the pre-PHP-7.0 era. This also implicitly solves
GH-20564 by not clearing exceptions before entering the autoloader.
Closes GH-20256
Fixes GH-20564
The arg_info member of zend_function is now always a zend_arg_info*. Before,
it was a zend_internal_arg_info* on internal functions, unless the
ZEND_ACC_USER_ARG_INFO flag was set.
Closes GH-19022
The initial motivation was to see if it is possible to make the `func` field of `_zend_execute_data` constant.
For various reasons, this is not possible, but the added `const` qualifiers during this exploration remain useful.
This cache is implemented in two levels: A EG(callable_convert_cache) global
that maps zend_function pointers to a shared callable instance, and a
CALLABLE_CONVERT cache slot to remember the result of the hash table lookup.
Fixes GH-19754
Closes GH-19863
Ilija Tovilo