Fix GH-25007: PFA named args in constant expression write out of bounds (#25012)

Author: lazerg

NEWS

@@ -9,6 +9,8 @@ PHP                                                                        NEWS
     (Marti2203).
   . Fixed bug GH-25023 (ZEND_CONTAINER_OF() fails to compile with -std=c11).
     (lazerg)
+  . Fixed bug GH-25007 (Partial function application: named args in a constant
+    expression cause out-of-bounds write in zp_compile()). (lazerg)
 
 - CLI:
   . Fixed bug GH-24697 (PHP_HTTP_PARSER_STRICT build option doesn't work).
@@ -97,9 +99,9 @@ PHP                                                                        NEWS
     (ndossche, khaledalam)
 
 - OpenSSL:
+  . Fixed build with OpenSSL 4.1. (Weilin Du)
   . Fixed bug GH-24784 (openssl_pkcs7_read() and openssl_cms_read() overwrite
     certificates with CRLs). (Alexander Danilov)
-  . Fixed build with OpenSSL 4.1. (Weilin Du)
 
 - PDO_PGSQL:
   . Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops

Zend/tests/partial_application/gh25007.phpt

@@ -0,0 +1,31 @@
+--TEST--
+GH-25007 (PFA in constexpr: named args before a named placeholder)
+--FILE--
+<?php
+
+function f($a, $b = 2, $c = 3) {
+    var_dump(func_get_args());
+}
+
+const C1 = f(a: 1, b: ?);
+const C2 = f(a: 1, c: ?, b: ?);
+
+(C1)(4);
+(C2)(5, 6);
+
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(4)
+}
+array(3) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(6)
+  [2]=>
+  int(5)
+}

Zend/zend_ast.c

@@ -701,14 +701,6 @@ static zend_execute_data *zend_ast_evaluate_arg_list(
 			if (!arg) {
 				goto fail;
 			}
-			if (named_positions_ptr) {
-				if (!*named_positions_ptr) {
-					*named_positions_ptr = zend_new_array(0);
-				}
-				zval tmp;
-				ZVAL_LONG(&tmp, zend_hash_num_elements(*named_positions_ptr));
-				zend_hash_add(*named_positions_ptr, arg_name, &tmp);
-			}
 			arg_ast = arg_ast->child[1];
 		} else {
 			arg = ZEND_CALL_VAR_NUM(frame, ZEND_CALL_NUM_ARGS(frame));
@@ -724,6 +716,14 @@ static zend_execute_data *zend_ast_evaluate_arg_list(
 			} else {
 				Z_TYPE_INFO_P(arg) = _IS_PLACEHOLDER;
 			}
+			if (arg_name && named_positions_ptr) {
+				if (!*named_positions_ptr) {
+					*named_positions_ptr = zend_new_array(0);
+				}
+				zval tmp;
+				ZVAL_LONG(&tmp, zend_hash_num_elements(*named_positions_ptr));
+				zend_hash_add(*named_positions_ptr, arg_name, &tmp);
+			}
 		} else {
 			if (zend_ast_evaluate_ex(arg, arg_ast, scope, short_circuited_ptr, ctx) == FAILURE) {
 				ZVAL_UNDEF(arg);