Commit 758abd57d38 for php

commit 758abd57d38afe3048bb6e9563cbe37594961d6b
Author: David Carlier <devnexen@gmail.com>
Date:   Sun Oct 18 12:13:02 2026 +0100

    Zend: fix find_frameless_function_offset() walking past the handler array

    The loop tested the cursor pointer, not the slot, so it never stopped on the
    NULL terminator. It now checks the slot, and the caller advances instead of
    spinning on continue.

    Close GH-23516

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index ffd40f06014..f33ae242fee 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -4916,13 +4916,15 @@ static uint32_t find_frameless_function_offset(uint32_t arity, const void *handl
 {
 	void **handlers = zend_flf_handlers;
 	void **current = handlers;
-	while (current) {
+	while (*current) {
 		if (*current == handler) {
 			return current - handlers;
 		}
 		current++;
 	}

+	/* Unreachable in practice: zend_register_functions() records the handler
+	 * of every frameless_function_infos entry at registration time. */
 	return (uint32_t)-1;
 }

@@ -4952,10 +4954,9 @@ static const zend_frameless_function_info *find_frameless_function_info(const ze
 		  || frameless_function_info->num_args == args->children)) {
 			uint32_t num_args = frameless_function_info->num_args;
 			uint32_t offset = find_frameless_function_offset(num_args, frameless_function_info->handler);
-			if (offset == (uint32_t)-1) {
-				continue;
+			if (offset != (uint32_t)-1) {
+				return frameless_function_info;
 			}
-			return frameless_function_info;
 		}
 		frameless_function_info++;
 	}