Fixes

Author: iluuu1994

Zend/zend_compile.c

@@ -4562,6 +4562,10 @@ static zend_result zend_compile_frameless_icall(znode *result, zend_ast_list *ar
 		return FAILURE;
 	}
 
+	if (args->children > 3) {
+		return FAILURE;
+	}
+
 	/* We don't support named arguments or argument unpacking. */
 	for (uint32_t i = 0; i < args->children; i++) {
 		zend_ast *arg = args->child[i];
@@ -4588,6 +4592,7 @@ static zend_result zend_compile_frameless_icall(znode *result, zend_ast_list *ar
 			}
 			uint8_t opcode = ZEND_FRAMELESS_ICALL_0 + args->children;
 			zend_op *opline = zend_emit_op_tmp(result, opcode, NULL, NULL);
+			opline->extended_value = offset;
 			if (args->children >= 1) {
 				SET_NODE(opline->op1, &arg1);
 			}
@@ -4597,7 +4602,6 @@ static zend_result zend_compile_frameless_icall(znode *result, zend_ast_list *ar
 			if (args->children >= 3) {
 				zend_emit_op_data(&arg3);
 			}
-			opline->extended_value = offset;
 			return SUCCESS;
 		}
 		frameless_function_info++;

Zend/zend_frameless_function.h

@@ -49,6 +49,11 @@
 		zend_wrong_parameter_type_error(arg_num, Z_EXPECTED_LONG, arg ## arg_num); \
 		goto flf_clean; \
 	}
+#define Z_FLF_PARAM_LONG_OR_NULL(arg_num, is_null, dest) \
+	if (!zend_parse_arg_long(arg ## arg_num, &dest, &is_null, /* null_check */ true, arg_num)) { \
+		zend_wrong_parameter_type_error(arg_num, Z_EXPECTED_LONG_OR_NULL, arg ## arg_num); \
+		goto flf_clean; \
+	}
 #define Z_FLF_PARAM_STR(arg_num, dest, tmp) \
 	if (Z_TYPE_P(arg ## arg_num) == IS_STRING) { \
 		dest = Z_STR_P(arg ## arg_num); \

ext/standard/basic_functions.stub.php

@@ -2425,6 +2425,7 @@ function chunk_split(string $string, int $length = 76, string $separator = "\r\n
 /**
  * @compile-time-eval
  * @frameless-function {"arity": 2}
+ * @frameless-function {"arity": 3}
  */
 function substr(string $string, int $offset, ?int $length = null): string {}
 

ext/standard/basic_functions_arginfo.h

@@ -2206,12 +2206,13 @@ ZEND_FRAMELESS_FUNCTION(substr, 3)
 	zval str_tmp;
 	zend_string *str;
 	zend_long f, l;
+	bool len_is_null;
 
 	Z_FLF_PARAM_STR(1, str, str_tmp);
 	Z_FLF_PARAM_LONG(2, f);
-	Z_FLF_PARAM_LONG(3, l);
+	Z_FLF_PARAM_LONG_OR_NULL(3, len_is_null, l);
 
-	_zend_substr(return_value, str, f, /* len_is_null */ false, l);
+	_zend_substr(return_value, str, f, len_is_null, l);
 
 flf_clean:
 	Z_FLF_PARAM_FREE_STR(1, str_tmp);