Fix GH-23232: is_callable('\::method') asks the autoloader for an empty class name - #23233
Draft
spawnia wants to merge 1 commit into
Draft
Fix GH-23232: is_callable('\::method') asks the autoloader for an empty class name#23233spawnia wants to merge 1 commit into
spawnia wants to merge 1 commit into
Conversation
…empty class name A class name consisting solely of the namespace separator passed the length check in zend_lookup_class_ex(), lost its leading backslash and was then looked up and autoloaded as an empty string.
Girgias
approved these changes
Aug 12, 2026
Girgias
left a comment
Member
There was a problem hiding this comment.
This seems okay as a fix, might be worse to see if this can be prevent on the call sites for the future.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes GH-23232.
zend_lookup_class_ex()rejects an empty class name, but not a name consisting solely of the namespace separator:"\"passes the length check, gets its leading\stripped, and is then looked up — and autoloaded — as"".That is reachable from userland:
is_callable('\::method')splits at::, takes"\"as the class part and hands it tozend_lookup_class().is_callable('::method')is rejected as an invalid function name earlier, which is where the asymmetry in the issue comes from.A lone
\names no class, so returnNULLbefore consulting the class table or the autoloader.This is observable, not just wasted work: Composer's
ClassLoader::findFileWithExtension()does$first = $class[0];and warnsUninitialized string offset 0when handed'', which in applications that promote warnings to exceptions aborts the request. We hit it in CI through Laravel'sFactory::expandAttributes(), which callsis_callable()on every string attribute — a randomly generated password starting with\::was enough.Targeting
PHP-8.4as the lowest branch still receiving bug fixes.make testpasses onZend/testsandext/standard/tests/general_functions(5085 passed, 0 failed) in a debug build; the new.phptfails without the patch.