Skip to content

Fix GH-25007: PFA named args in constant expression write out of bounds - #25012

Open
lazerg wants to merge 1 commit into
php:PHP-8.6from
lazerg:fix/gh-25007
Open

lazerg wants to merge 1 commit into
php:PHP-8.6from
lazerg:fix/gh-25007

Conversation

@lazerg

@lazerg lazerg commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

In a constant expression, zend_ast_evaluate_arg_list() added every named argument to named_positions, while zend_compile_args_ex() only adds named placeholders. zp_compile() uses those positions to index the params array, which only has room for the placeholders, so f(a: 1, b: ?) wrote past the end of it. Now only named placeholders get a position, same as the compiled path.

Fixes #25007

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant