Fixed bug #74673 (Segfault when cast Reflection object to string with undefined constant)

Author: laruence

NEWS

@@ -15,6 +15,10 @@ PHP                                                                        NEWS
   . Fixed bug #74663 (Segfault with opcache.memory_protect and
     validate_timestamp). (Laruence)
 
+- Reflection:
+  . Fixed bug #74673 (Segfault when cast Reflection object to string with
+    undefined constant). (Laruence)
+
 - SPL:
   . Fixed bug #74478 (null coalescing operator failing with SplFixedArray).
     (jhdxr)

ext/reflection/php_reflection.c

@@ -462,7 +462,9 @@ static void _class_string(string *str, zend_class_entry *ce, zval *obj, char *in
 		zval *value;
 
 		ZEND_HASH_FOREACH_STR_KEY_VAL(&ce->constants_table, key, value) {
-			zval_update_constant_ex(value, 1, NULL);
+			if (UNEXPECTED(zval_update_constant_ex(value, 1, NULL) == FAILURE)) {
+				return;
+			}
 			_const_string(str, ZSTR_VAL(key), value, indent);
 		} ZEND_HASH_FOREACH_END();
 	}
@@ -708,7 +710,11 @@ static void _parameter_string(string *str, zend_function *fptr, struct _zend_arg
 			ZVAL_DUP(&zv, RT_CONSTANT(&fptr->op_array, precv->op2));
 			old_scope = EG(scope);
 			EG(scope) = fptr->common.scope;
-			zval_update_constant_ex(&zv, 1, NULL);
+			if (UNEXPECTED(zval_update_constant_ex(&zv, 1, NULL) == FAILURE)) {
+				EG(scope) = old_scope;
+				zval_ptr_dtor(&zv);
+				return;
+			}
 			EG(scope) = old_scope;
 			if (Z_TYPE(zv) == IS_TRUE) {
 				string_write(str, "true", sizeof("true")-1);

ext/reflection/tests/bug74673.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #74673 (Segfault when cast Reflection object to string with undefined constant)
+--FILE--
+<?php
+
+set_error_handler(function() {
+    throw new Exception();
+});
+
+class A
+{
+	public function method($test = PHP_SELF + 1)
+	{
+	}
+}
+
+$class = new ReflectionClass('A');
+
+echo $class;
+?>
+--EXPECTF--
+Fatal error: Method ReflectionClass::__toString() must not throw an exception, caught Exception:  in %sbug74673.php on line %d