Assertion failure in zif_highlight_string when messing up output buffers

[vi3tL0u1s]

Description

The following code:

<?php
class A {
    function __destruct() {
        highlight_string("<?php", true);
        trigger_error("");
        ob_start(function () use (&$c) { $c = new A; return '/'; }, 1);
        $c = new A;
        unset($c);
        ob_start(function &() use (&$c) { $c = new A; return '/'; }, 1);
    }
}
new A;

Resulted in this output:

/php: /path/to/php-src/ext/standard/basic_functions.c:1837: zif_highlight_string: Assertion `zval_get_type(&(*(return_value))) == 6' failed.
Aborted

Commit

2813f62476f6fb1b8d59f25527dbf2953fdf69a7

Configurations

./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic --enable-mbstring --with-zlib

PHP Version

PHP 8.6.0-dev (cli) (built: Jan 11 2026 13:54:51) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04

[ndossche]

This isn't related to destructors at all, but to the fact that highlight_string uses output buffers internally and you mess up that state.

Anyway, can you also please guide your fuzzer to not generate self-recursive destruction code, these are never realistic and horrible to debug.

[vi3tL0u1s]

Thanks for the clarification, noted.

[ndossche]

This would work I suppose, but not pretty of course. Also worth noting that highlight_file has the same bug.

diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index dc6146aec9d..58324f49902 100644
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -1817,7 +1817,10 @@ PHP_FUNCTION(highlight_string)
 	ZEND_PARSE_PARAMETERS_END();
 
 	if (i) {
-		php_output_start_default();
+		if (php_output_start_default() != SUCCESS) {
+			zend_throw_error(NULL, "Unable to start output handler");
+			RETURN_THROWS();
+		}
 	}
 
 	EG(error_reporting) = E_ERROR;