From 82ea3f593b5f91a9dbfd4a29a511fd57e3f6bb80 Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Sun, 19 Jan 2025 07:27:05 +0000
Subject: [PATCH] Fix GH-17516: SplFileTempObject::getPathInfo() crash on
 invalid class.

This no longer caught the case where an non SplFileInfo/inherited class
of nwas passed since the refactoring in 8.4.
---
 ext/spl/spl_directory.c    |  3 +++
 ext/spl/tests/gh17516.phpt | 24 ++++++++++++++++++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 ext/spl/tests/gh17516.phpt

diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
index f578fb07e9d4a..cb9d6586635e3 100644
--- a/ext/spl/spl_directory.c
+++ b/ext/spl/spl_directory.c
@@ -1368,6 +1368,9 @@ PHP_METHOD(SplFileInfo, getPathInfo)
 
 	if (ce == NULL) {
 		ce = intern->info_class;
+	} else if (!instanceof_function(ce, spl_ce_SplFileInfo)) {
+		zend_argument_type_error(1, "must be a class name derived from %s or null, %s given", ZSTR_VAL(spl_ce_SplFileInfo->name), ZSTR_VAL(ce->name));
+		RETURN_THROWS();
 	}
 
 	path = spl_filesystem_object_get_pathname(intern);
diff --git a/ext/spl/tests/gh17516.phpt b/ext/spl/tests/gh17516.phpt
new file mode 100644
index 0000000000000..f1a05f9ca1849
--- /dev/null
+++ b/ext/spl/tests/gh17516.phpt
@@ -0,0 +1,24 @@
+--TEST--
+GH-17516 SplTempFileObject::getPathInfo() crashes on invalid class ID.
+--FILE--
+<?php
+$cls = new SplTempFileObject();
+class SplFileInfoChild extends SplFileInfo {}
+class BadSplFileInfo {}
+
+var_dump($cls->getPathInfo('SplFileInfoChild'));
+
+try {
+	$cls->getPathInfo('BadSplFileInfo');
+} catch (\TypeError $e) {
+	echo $e->getMessage();
+}
+?>
+--EXPECT--
+object(SplFileInfoChild)#2 (2) {
+  ["pathName":"SplFileInfo":private]=>
+  string(4) "php:"
+  ["fileName":"SplFileInfo":private]=>
+  string(4) "php:"
+}
+SplFileInfo::getPathInfo(): Argument #1 ($class) must be a class name derived from SplFileInfo or null, BadSplFileInfo given