Fix GH-23232: is_callable('\::method') asks the autoloader for an empty class name

[spawnia]

Fixes GH-23232.

zend_lookup_class_ex() rejects an empty class name, but not a name consisting solely of the namespace separator: "\" passes the length check, gets its leading \ stripped, and is then looked up — and autoloaded — as "".

That is reachable from userland: is_callable('\::method') splits at ::, takes "\" as the class part and hands it to zend_lookup_class(). is_callable('::method') is rejected as an invalid function name earlier, which is where the asymmetry in the issue comes from.

A lone \ names no class, so return NULL before consulting the class table or the autoloader.

This is observable, not just wasted work: Composer's ClassLoader::findFileWithExtension() does $first = $class[0]; and warns Uninitialized string offset 0 when handed '', which in applications that promote warnings to exceptions aborts the request. We hit it in CI through Laravel's Factory::expandAttributes(), which calls is_callable() on every string attribute — a randomly generated password starting with \:: was enough.

Targeting PHP-8.4 as the lowest branch still receiving bug fixes.

make test passes on Zend/tests and ext/standard/tests/general_functions (5085 passed, 0 failed) in a debug build; the new .phpt fails without the patch.

[Girgias]

This seems okay as a fix, might be worse to see if this can be prevent on the call sites for the future.

[spawnia]

Thanks! I put the guard in zend_lookup_class_ex() deliberately: every path that can produce a lone \ — is_callable(), class_exists(), string-callable invocation, callable type coercion — funnels through it, so one check covers them all and no future call site can regress.

Validating at the call sites would mean duplicating "is this even a syntactically possible class name?" in each of them. zend_is_callable_check_class() is the main offender today: it hands over whatever precedes :: without inspecting it. Happy to follow up with a stricter check there (and in the other string-callable parsers) as a separate PR if you'd prefer that on top — it would turn the autoloader call into a no-op earlier, but it is a behaviour question rather than a bug fix.

[spawnia]

For the record, the two userland-side fixes were both declined, which leaves this the only remaining place to fix it — and arguably the right level anyway.

• Laravel: Do not call is_callable() on string factory attributes laravel/framework#61151 reordered Factory::expandAttributes() so is_callable() is not called on plain string attributes. Closed without comment.
• Composer: Return early from ClassLoader::findFile() for an empty class name composer/composer#13031 returned early from ClassLoader::findFile() for an empty class name. Declined by @Seldaek in Return early from ClassLoader::findFile() for an empty class name composer/composer#13031 (comment): "This is always a bug in the calling code IMO, so I don't want to account for it with an additional check in a code path that is executed to load every single class in almost all PHP projects, that's just wasteful. Callers should ensure they do not use empty class names as that is never a valid class."

That reasoning points here: the caller handing Composer an empty class name is the engine itself, via zend_lookup_class_ex() stripping the leading \ from "\". No userland code asked for the class ''.

[Seldaek]

Indeed, autoloading '\' or '' is the same silly thing nobody should be doing. But yeah if php core can stop calling autoloaders for it that's also good.

[Girgias]

I'm realising that this is a long standing behavioural change (even if it is dumb) so I'd prefer to only target master for this.