Commit 5df5e4a20ec for php

commit 5df5e4a20eccc286b991aac2fbb49f6920d0fd3a
Merge: 01e431b1e94 febae1cbfd9
Author: Jorg Sowa <jorg.sowa@gmail.com>
Date:   Mon Nov 9 23:04:59 2026 +0100

    Merge branch 'PHP-8.4' into PHP-8.5

diff --cc NEWS
index cd11801b3cb,04f6aec330c..c0da02811a2
--- a/NEWS
+++ b/NEWS
@@@ -12,12 -12,15 +12,15 @@@ PH
      of class names in implements, catch, and trait use lists. (Jorg Sowa)
    . Fixed AST export dropping the braces of dynamic class constant fetches.
      (Jorg Sowa)
 +  . Fixed bug GH-25238 (ReflectionProperty::isInitialized() skips lazy init once
 +    cached). (lazerg)
    . Fixed bug GH-25265 (Misaligned read for virtual internal props in
      hooked subclass). (Lazizbek Ergashev)
 -  . Fixed bug GH-25299 (Exception string code is lost after unserialize()).
 -    (Lazizbek Ergashev, David Carlier)
    . Fixed bug GH-25302 (Use-after-free in zend_compile_const_decl() with
      OPcache during concurrent compilation). (Nicolas Grekas)
+   . Fixed use-after-free when the error handler releases a string while an
+     "Illegal string offset" warning is raised for its offset in a read, ?? or
+     nested isset()/empty(). (Jorg Sowa)

  - Curl:
    . Fixed curl_reset() retaining CURLOPT_PRIVATE after reset. (lacatoire)
@@@ -34,18 -43,13 +37,21 @@@
    . Fixed memory leak in JIT ASSIGN_DIM when the assignment fails. (Jorg Sowa)
    . Fixed bug GH-16396 (Failed to invoke user error handler during index
      conversion in JIT). (Jorg Sowa)
 +  . Fixed bug GH-24801 (JIT: SIGFPE in ir_fold MUL_OV constant folding).
 +    (waroad)
    . Fixed bug GH-25037 (Function JIT ENTRY live var assertion).
      (Ilia Alshanetsky)
 +  . Fixed bug GH-25195 (smm_shared_globals left dangling without an
 +    SHM backend). (Grégoire Pineau)
 +  . Fixed bug GH-25269 (JIT: misaligned zval passed to
 +    ZEND_ADD_ARRAY_ELEMENT handler). (Jorg Sowa, ndossche)
 +  . Fixed bug GH-25253 (JIT reads parent of an unlinked class).
 +    (lazerg, mlenarciak)
    . Fixed JIT ignoring leading-numeric string offsets in isset(), empty() and
      ??. (Jorg Sowa)
+   . Fixed use-after-free in JIT when the error handler releases a string while
+     an "Undefined variable" warning is raised for its offset in ?? or nested
+     isset()/empty(). (Jorg Sowa)

  - PDO_Firebird:
    . Fixed stack buffer overflow with long connection user names, passwords,
diff --cc ext/opcache/jit/zend_jit_helpers.c
index 576fb1f8c3d,0579f1d2592..cdc122d7a67
--- a/ext/opcache/jit/zend_jit_helpers.c
+++ b/ext/opcache/jit/zend_jit_helpers.c
@@@ -1283,14 -1131,21 +1283,23 @@@ try_string_offset
  						return;
  					}
  				}
 -				break;
 +				goto out;
  			}
 +			case IS_DOUBLE:
 +				offset = zend_dval_to_lval_silent(Z_DVAL_P(dim));
 +				goto out;
  			case IS_UNDEF:
+ 				/* The string may be destroyed while throwing the notice */
+ 				if (!(GC_FLAGS(str) & IS_STR_INTERNED)) {
+ 					GC_ADDREF(str);
+ 				}
  				zend_jit_undefined_op_helper(EG(current_execute_data)->opline->op2.var);
+ 				if (!(GC_FLAGS(str) & IS_STR_INTERNED) && UNEXPECTED(GC_DELREF(str) == 0)) {
+ 					zend_string_efree(str);
+ 					ZVAL_NULL(result);
+ 					return;
+ 				}
  				ZEND_FALLTHROUGH;
 -			case IS_DOUBLE:
  			case IS_NULL:
  			case IS_FALSE:
  			case IS_TRUE: