Commit 3213c3faa64 for php.net

commit 3213c3faa641265868f0d6aec3c17462382d5809
Author: ndossche <7771979+ndossche@users.noreply.github.com>
Date:   Sat Sep 19 20:04:37 2026 +0200

    Fix OSS-Fuzz #546798343: Heap-buffer-overflow in zend_delete_call_instructions with callable conversion

    Call level counter was broken: ZEND_CALLABLE_CONVERT was forgotten.

    Closes GH-23777.

diff --git a/NEWS b/NEWS
index 51580b6c778..2eef981bcf6 100644
--- a/NEWS
+++ b/NEWS
@@ -34,6 +34,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in
     a truncated UTF-8 sequence). (Lazizbek Ergashev)

+- Opcache:
+  . Fixed OSS-Fuzz #546798343 (Heap-buffer-overflow in optimizer with
+    FCCs and inlining). (ndossche)
+
 - PDO:
   . Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid
     column index. (Ilia Alshanetsky)
diff --git a/Zend/Optimizer/optimize_func_calls.c b/Zend/Optimizer/optimize_func_calls.c
index ce6c43afaed..5449535c560 100644
--- a/Zend/Optimizer/optimize_func_calls.c
+++ b/Zend/Optimizer/optimize_func_calls.c
@@ -63,6 +63,7 @@ static void zend_delete_call_instructions(zend_op_array *op_array, zend_op *opli
 			case ZEND_DO_ICALL:
 			case ZEND_DO_UCALL:
 			case ZEND_DO_FCALL_BY_NAME:
+			case ZEND_CALLABLE_CONVERT:
 				call++;
 				break;
 			case ZEND_SEND_VAL:
diff --git a/ext/opcache/tests/opt/oss_fuzz_546798343.phpt b/ext/opcache/tests/opt/oss_fuzz_546798343.phpt
new file mode 100644
index 00000000000..f7f058a1165
--- /dev/null
+++ b/ext/opcache/tests/opt/oss_fuzz_546798343.phpt
@@ -0,0 +1,19 @@
+--TEST--
+OSS-Fuzz #546798343 (Heap-buffer-overflow in zend_delete_call_instructions with callable conversion)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+--FILE--
+<?php
+
+$x = function() {};
+gonnaBeInlined($x(...));
+function gonnaBeInlined($foo) {
+}
+
+echo "Done";
+?>
+--EXPECT--
+Done