From 27f32afc3dcb34c7a240753b1ced2714ca6f28b7 Mon Sep 17 00:00:00 2001
From: ndossche <7771979+ndossche@users.noreply.github.com>
Date: Sat, 19 Sep 2026 20:04:37 +0200
Subject: [PATCH] Fix OSS-Fuzz #546798343: Heap-buffer-overflow in
 zend_delete_call_instructions with callable conversion

Call level counter was broken: ZEND_CALLABLE_CONVERT was forgotten.
---
 Zend/Optimizer/optimize_func_calls.c          |  1 +
 ext/opcache/tests/opt/oss_fuzz_546798343.phpt | 16 ++++++++++++++++
 2 files changed, 17 insertions(+)
 create mode 100644 ext/opcache/tests/opt/oss_fuzz_546798343.phpt

diff --git a/Zend/Optimizer/optimize_func_calls.c b/Zend/Optimizer/optimize_func_calls.c
index ce6c43afaedb..5449535c560a 100644
--- a/Zend/Optimizer/optimize_func_calls.c
+++ b/Zend/Optimizer/optimize_func_calls.c
@@ -63,6 +63,7 @@ static void zend_delete_call_instructions(zend_op_array *op_array, zend_op *opli
 			case ZEND_DO_ICALL:
 			case ZEND_DO_UCALL:
 			case ZEND_DO_FCALL_BY_NAME:
+			case ZEND_CALLABLE_CONVERT:
 				call++;
 				break;
 			case ZEND_SEND_VAL:
diff --git a/ext/opcache/tests/opt/oss_fuzz_546798343.phpt b/ext/opcache/tests/opt/oss_fuzz_546798343.phpt
new file mode 100644
index 000000000000..0d9522c314e5
--- /dev/null
+++ b/ext/opcache/tests/opt/oss_fuzz_546798343.phpt
@@ -0,0 +1,16 @@
+--TEST--
+OSS-Fuzz #546798343 (Heap-buffer-overflow in zend_delete_call_instructions with callable conversion)
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+
+$x = function() {};
+gonnaBeInlined($x(...));
+function gonnaBeInlined($foo) {
+}
+
+echo "Done";
+?>
+--EXPECT--
+Done