Commit 8d38af63ce9 for php.net

commit 8d38af63ce9fd8346be95bf30600e4624b5a8b8f
Author: Gina Peter Banyard <girgias@php.net>
Date:   Sat Sep 19 14:28:54 2026 +0100

    Zend: fix OSS-Fuzz 532353396, static is a built-in type

    And thus should never be allowed to be qualified, as this lead to other bugs such as it not considered to be a built-in type by Reflection if it had a namespace component.

    We *may* want to extend the unqualified restriction to self and parent in the future.

    Closes GH-23768

diff --git a/NEWS b/NEWS
index be02d0d58cc..5c253140522 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,7 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug GH-23644 (Optimizer leaves a constant-vs-constant comparison
     unfolded, crashing the VM in zval_undefined_cv). (ndossche)
+  . Fixed OSS-Fuzz 532353396 (assertion failure with static type). (Girgias)

 - DOM:
   . Fixed use-after-free when re-constructing a DOMXPath whose php:function
diff --git a/Zend/tests/type_declarations/relative_types/static/fully_qualified_static.phpt b/Zend/tests/type_declarations/relative_types/static/fully_qualified_static.phpt
new file mode 100644
index 00000000000..4967e3f3d11
--- /dev/null
+++ b/Zend/tests/type_declarations/relative_types/static/fully_qualified_static.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Fully qualified (leading backslash) static type names must fail
+--DESCRIPTION--
+OSS-Fuzz: https://issues.oss-fuzz.com/issues/532353396
+--FILE--
+<?php
+
+function test($i): \static {}
+
+?>
+--EXPECTF--
+Fatal error: Type declaration 'static' must be unqualified in %s on line %d
diff --git a/Zend/tests/type_declarations/relative_types/static/namespace_relative_static.phpt b/Zend/tests/type_declarations/relative_types/static/namespace_relative_static.phpt
new file mode 100644
index 00000000000..0c1cde76f14
--- /dev/null
+++ b/Zend/tests/type_declarations/relative_types/static/namespace_relative_static.phpt
@@ -0,0 +1,12 @@
+--TEST--
+namespace\static is not a valid type declaration
+--DESCRIPTION--
+OSS-Fuzz: https://issues.oss-fuzz.com/issues/532353396
+--FILE--
+<?php
+
+function test($i): namespace\static {}
+
+?>
+--EXPECTF--
+Fatal error: Type declaration 'static' must be unqualified in %s on line %d
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index d8d61ea979e..94187366384 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -272,6 +272,7 @@ static const builtin_type_info builtin_types[] = {
 	{ZEND_STRL("iterable"), IS_ITERABLE},
 	{ZEND_STRL("object"), IS_OBJECT},
 	{ZEND_STRL("mixed"), IS_MIXED},
+	{ZEND_STRL("static"), IS_STATIC},
 	{NULL, 0, IS_UNDEF}
 };

@@ -7100,6 +7101,8 @@ static zend_type zend_compile_single_typename(zend_ast *ast)
 					ZSTR_VAL(zend_string_tolower(type_name)));
 			}

+			ZEND_ASSERT(type_code != IS_STATIC && "unqualified static type should have been handled by ZEND_AST_TYPE branch");
+
 			/* Transform iterable into a type union alias */
 			if (type_code == IS_ITERABLE) {
 				/* Set iterable bit for BC compat during Reflection and string representation of type */