Repository navigation
Closure named argument unpacking between temporary closures can cause a crash #19653
Description
Description
The following code:
<?php
function func1(string $a1 = 'a1', string $a2 = 'a2', string $a3 = 'a3') {
echo __FUNCTION__ . "() a1=$a1 a2=$a2 a3=$a3\n";
}
function usage1(?Closure $func1 = null) {
echo __FUNCTION__ . "() ";
($func1 ?? func1(...))(a3: 'm3+');
}
usage1();
$func1 = function (string ...$args) {
echo "[function] ";
func1(...$args, a2: 'm2+');
};
usage1(func1: $func1);Resulted in this output:
usage1() func1() a1=a1 a2=a2 a3=m3+
usage1() zend_mm_heap corrupted
Aborted
But I expected this output instead:
usage1() func1() a1=a1 a2=a2 a3=m3+
usage1() [function] func1() a1=a1 a2=m2+ a3=m3+
moreover, if I comment out the first call to usage1 with empty argument list, the second call succeeds
PHP Version
PHP 8.4.11 (cli) (built: Aug 3 2025 08:49:56) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.11, Copyright (c) Zend Technologies
with Zend OPcache v8.4.11, Copyright (c), by Zend Technologies
Operating System
No response
Activity
ndossche commentedon Aug 31, 2025
Can repro, fails with
opline->opcode == 63in debug mode. Will make a look. Thanks for reporting.EDIT: also breaks on PHP 8.3.
EDIT 2: it seems variadics are broken wrt the loop in zend_handle_undef_args() EDIT: (no actually that seems fine)
EDIT 3: and cache slot priming in ZEND_SEND_VAL_EX assuming the argument number stays the same ...
ivan-u7n commentedon Aug 31, 2025
@nielsdos
yeah, I've got to heap corruption, but it all started with ridiculous
ArgumentCountError: {closure:file.php:164}(): Argument #1 not passedin a larger codebasendossche commentedon Aug 31, 2025
The root cause is that
zend_handle_named_argstores thefbcand assumes its address is unique. However, that's not the case: for closures it's possible a memory address is reused leading to unexpected equality between functions that are not actually equal.[-]`zend_mm_heap corrupted` in closure named arguments unpacking?[/-][+]Closure named argument unpacking between temporary closures can cause a crash[/+]Fix phpGH-19653: Closure named argument unpacking between temporary c…
Merge branch 'PHP-8.3' into PHP-8.4
Merge branch 'PHP-8.4'
Fix GH-19653: Closure named argument unpacking between temporary clos…