Commit 7ad79be6550 for php.net
commit 7ad79be6550fba20df3d7cea0a5d9da79861c1f9
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date: Sun Jul 26 18:10:28 2026 +0200
Fix use-of-uninitialized-value ast->lineno
Exposed after GH-22833. ast->kind in this context may refer to a ZEND_AST_ZVAL,
for which accessing lineno is incorrect. lineno is stored in zval.u2 instead.
Fixes OSS-Fuzz-539121135
diff --git a/Zend/tests/oss-fuzz-539121135.phpt b/Zend/tests/oss-fuzz-539121135.phpt
new file mode 100644
index 00000000000..bf44d659cd7
--- /dev/null
+++ b/Zend/tests/oss-fuzz-539121135.phpt
@@ -0,0 +1,12 @@
+--TEST--
+OSS-Fuzz-539121135: Use-of-uninitialized-value ast->lineno
+--FILE--
+<?php
+
+namespace {}
+
+''
+
+?>
+--EXPECTF--
+Fatal error: No code may exist outside of namespace {} in %s on line %d
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 450b192ac48..2466710f9ce 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -12215,7 +12215,7 @@ static void zend_compile_stmt(zend_ast *ast) /* {{{ */
return;
}
- CG(zend_lineno) = ast->lineno;
+ CG(zend_lineno) = zend_ast_get_lineno(ast);
if ((CG(compiler_options) & ZEND_COMPILE_EXTENDED_STMT) && !zend_is_unticked_stmt(ast)) {
zend_do_extended_stmt(NULL);