fix: Fixed zend_std_read_property() priming the SIMPLE_GET property-hook

    cache-slot bit while the currently-executing opline was anything
    other than a plain ZEND_FETCH_OBJ_R (in particular
    ZEND_FETCH_OBJ_FUNC_ARG, which dispatches into the same handler for
    by-value argument fetches). Once primed, subsequent hook reads went
    through the SIMPLE_GET fast path with a mismatched opline and read
    garbage from an adjacent property slot, typically surfacing as a
    ValueError "must not contain any null bytes", a TypeError
    referencing the neighbouring slot's class, or a heap-corruption
    abort. Mirrors the opline check already used for SIMPLE_READ.
    (coderzhao)

Author: coderzhao

NEWS

@@ -6,6 +6,17 @@ PHP                                                                        NEWS
   . Implemented partial function application RFC. (Arnaud)
   . Fixed bug GH-22263 (reset typed property default on every unserialize
     failure path). (David Carlier)
+  . Fixed zend_std_read_property() priming the SIMPLE_GET property-hook
+    cache-slot bit while the currently-executing opline was anything
+    other than a plain ZEND_FETCH_OBJ_R (in particular
+    ZEND_FETCH_OBJ_FUNC_ARG, which dispatches into the same handler for
+    by-value argument fetches). Once primed, subsequent hook reads went
+    through the SIMPLE_GET fast path with a mismatched opline and read
+    garbage from an adjacent property slot, typically surfacing as a
+    ValueError "must not contain any null bytes", a TypeError
+    referencing the neighbouring slot's class, or a heap-corruption
+    abort. Mirrors the opline check already used for SIMPLE_READ.
+    (coderzhao)
 
 - DOM:
   . Fixed bug GH-22825 (DOMElement::setAttribute() fails silently when the DTD

Zend/tests/property_hooks/virtual_hook_as_func_arg.phpt

@@ -0,0 +1,94 @@
+--TEST--
+Virtual property hook read via FETCH_OBJ_FUNC_ARG must invoke the getter (function JIT)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit_buffer_size=64M
+opcache.jit=1205
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+
+namespace Regression;
+
+interface HandlerInterface { public function noop(): void; }
+
+final class DefaultHandler implements HandlerInterface {
+    private static ?self $i = null;
+    public static function getInstance(): self { return self::$i ??= new self(); }
+    public function noop(): void {}
+}
+
+class Container {
+    public protected(set) HandlerInterface $handler;
+
+    public string $path {
+        get => self::build($this->kind, $this->id);
+    }
+
+    protected mixed $prev = null;
+
+    public function __construct(
+        public protected(set) string $kind,
+        public protected(set) string $id,
+    ) {
+        $this->handler = DefaultHandler::getInstance();
+    }
+
+    public static function build(string $k, string $i): string {
+        return "/nonexistent/regression_{$k}_{$i}.dat";
+    }
+
+    /* Passes a virtual property hook directly as the first argument of an
+     * unqualified (namespace-fallback) global function. That fallback path
+     * emits INIT_NS_FCALL_BY_NAME + CHECK_FUNC_ARG + FETCH_OBJ_FUNC_ARG,
+     * and the FETCH_OBJ_FUNC_ARG handler tail-calls into the FETCH_OBJ_R
+     * handler for by-value arguments.
+     *
+     * zend_std_read_property() must not prime the SIMPLE_GET property-hook
+     * cache-slot bit while the currently-executing opline is anything
+     * other than a plain ZEND_FETCH_OBJ_R. If it does, subsequent hook
+     * reads (potentially via a JIT-compiled fast path for FUNC_ARG that
+     * has no hook-enter check) go through the SIMPLE_GET path with a
+     * mismatched opline and read garbage from an adjacent property slot,
+     * typically surfacing as ValueError "must not contain any null bytes"
+     * or a TypeError referencing the neighbour's class.
+     *
+     * Also exercises the same fetch under @-silencing (BEGIN_SILENCE /
+     * END_SILENCE) which is the exact shape observed in the wild. */
+    public function step(): void {
+        // First: a bare FETCH_OBJ_FUNC_ARG under a namespaced call.
+        $len = strlen($this->path);
+        if ($len === 0) {
+            throw new \RuntimeException('empty path from hook');
+        }
+        // Second: a silenced namespaced call with the hook as arg #1.
+        // file_get_contents() is a by-value string parameter so the
+        // FETCH_OBJ_FUNC_ARG dispatches into the FETCH_OBJ_R handler.
+        $r = @file_get_contents($this->path);
+        // The file does not exist, so a false return with a warning is
+        // expected. The important thing is that no ValueError / TypeError
+        // / heap corruption occurs while producing the argument.
+        if ($r !== false) {
+            throw new \RuntimeException('unexpected non-false return');
+        }
+    }
+}
+
+$c = new Container('alpha', 'beta');
+
+for ($i = 0; $i < 200; $i++) {
+    try {
+        $c->step();
+    } catch (\Throwable $e) {
+        printf("iter=%d threw %s: %s\n", $i, $e::class, $e->getMessage());
+        exit(1);
+    }
+}
+
+echo "OK\n";
+
+?>
+--EXPECT--
+OK

Zend/zend_object_handlers.c

@@ -863,7 +863,23 @@ ZEND_API zval *zend_std_read_property(zend_object *zobj, zend_string *name, int
 			goto try_again;
 		}
 
+		/* Only prime the SIMPLE_GET fast path for a plain ZEND_FETCH_OBJ_R
+		 * opline. ZEND_FETCH_OBJ_FUNC_ARG dispatches into this same handler
+		 * for by-value argument fetches, but its opline->extended_value can
+		 * carry the ZEND_FETCH_REF bit and its result slot lives inside the
+		 * pending call frame -- neither of which is accounted for by the
+		 * SIMPLE_GET fast path in zend_vm_def.h. Caching the bit under a
+		 * FETCH_OBJ_FUNC_ARG opline would let a later FETCH_OBJ_R (or a
+		 * JIT-compiled FUNC_ARG that has no hook-enter check) hit that fast
+		 * path with a mismatched opline and read garbage from the adjacent
+		 * property slot -- typically surfacing as a "must not contain any
+		 * null bytes" ValueError, an "expected string, got <Class>"
+		 * TypeError, or a heap corruption abort. Mirrors the opline check
+		 * already used for SIMPLE_READ above. */
+		const zend_execute_data *execute_data = EG(current_execute_data);
 		if (EXPECTED(cache_slot
+		 && EX(opline)
+		 && EX(opline)->opcode == ZEND_FETCH_OBJ_R
 		 && zend_execute_ex == execute_ex
 		 && ce->default_object_handlers->read_property == zend_std_read_property
 		 && !ce->create_object