From 7daa76c01e475da2c86fe155d141ef436f481c4d Mon Sep 17 00:00:00 2001 From: ndossche <7771979+ndossche@users.noreply.github.com> Date: Sun, 20 Sep 2026 12:04:55 +0200 Subject: [PATCH] Fix OSS-Fuzz #538730793: Assertion failure when returning by-ref from closure invoke Forgot one place in this file where we have to unwrap the reference, the `zend_closure_call_magic` function had this already but the invoke was missing. --- Zend/tests/closures/oss_fuzz_538730793.phpt | 13 +++++++++++++ Zend/zend_closures.c | 1 + 2 files changed, 14 insertions(+) create mode 100644 Zend/tests/closures/oss_fuzz_538730793.phpt diff --git a/Zend/tests/closures/oss_fuzz_538730793.phpt b/Zend/tests/closures/oss_fuzz_538730793.phpt new file mode 100644 index 000000000000..e5347a03ee90 --- /dev/null +++ b/Zend/tests/closures/oss_fuzz_538730793.phpt @@ -0,0 +1,13 @@ +--TEST-- +OSS-Fuzz #538730793 (Assertion failure when returning by-ref from closure invoke) +--FILE-- +__invoke(); +var_dump($y); + +?> +--EXPECTF-- +Notice: Only variable references should be returned by reference in %s on line %d +NULL diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c index 4aa467315907..44f7db5020f2 100644 --- a/Zend/zend_closures.c +++ b/Zend/zend_closures.c @@ -74,6 +74,7 @@ ZEND_METHOD(Closure, __invoke) /* {{{ */ zend_closure_get_closure(Z_OBJ_P(ZEND_THIS), &fcc.calling_scope, &fcc.function_handler, &fcc.object, false); fcc.called_scope = fcc.calling_scope; zend_call_known_fcc(&fcc, return_value, num_args, args, named_args); + zend_return_unwrap_ref(execute_data, return_value); /* destruct the function also, then - we have allocated it in get_method */ zend_string_release_ex(func->internal_function.function_name, 0);