Merge branch 'PHP-8.4'

* PHP-8.4:
  Fix GH-19792: SCCP causes UAF for return value if both warning and exception are triggered

Author: ndossche

Zend/Optimizer/sccp.c

@@ -838,9 +838,7 @@ static inline zend_result ct_eval_func_call_ex(
 		zval_ptr_dtor(result);
 		zend_clear_exception();
 		retval = FAILURE;
-	}
-
-	if (EG(capture_warnings_during_sccp) > 1) {
+	} else if (EG(capture_warnings_during_sccp) > 1) {
 		zval_ptr_dtor(result);
 		retval = FAILURE;
 	}

ext/opcache/tests/opt/gh19792.phpt

@@ -0,0 +1,27 @@
+--TEST--
+GH-19792 (SCCP causes UAF for return value if both warning and exception are triggered)
+--EXTENSIONS--
+opcache
+zend_test
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+--FILE--
+<?php
+
+function foo()
+{
+    return \zend_test_gh19792();
+}
+
+try {
+    foo();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECTF--
+Warning: a warning in %s on line %d
+an exception

ext/zend_test/test.c

@@ -1731,3 +1731,12 @@ static PHP_FUNCTION(zend_test_opcache_preloading)
 
 	RETURN_BOOL(opcache_preloading());
 }
+
+static PHP_FUNCTION(zend_test_gh19792)
+{
+	ZEND_PARSE_PARAMETERS_NONE();
+
+	RETVAL_STRING("this is a non-interned string");
+	zend_error(E_WARNING, "a warning");
+	zend_throw_error(NULL, "an exception");
+}

ext/zend_test/test.stub.php

@@ -344,6 +344,9 @@ function zend_test_gh18756(): void {}
     function zend_test_opcache_preloading(): bool {}
 
     function zend_test_uri_parser(string $uri, string $parser): array { }
+
+    /** @compile-time-eval */
+    function zend_test_gh19792(): void {}
 }
 
 namespace ZendTestNS {