Repository navigation
Regression: password_hash(null) TypeError — Zend coerces null to empty string (ext/standard/password.c) #17023
Description
Category
stdlib · null operand coercion · php-src-strict
Problem
Zend/php-src coerces null to an empty string for password_hash()'s $password argument (non-strict user code). This compiler rejects the call with TypeError via VmString::coerceTypedStringBuiltinArg().
| Repro | Zend 8.2 | VM (2026-07-06) |
|---|---|---|
password_hash(null, PASSWORD_DEFAULT) |
non-empty hash string | TypeError |
php-src reference
- php/php-src
ext/standard/password.c—PHP_FUNCTION(password_hash)/zend_parse_parametersstring coercion
PHP implementation target
ext/standard/password_hash.php— useVmString::coerceStringBuiltinArg()(nullable →'') instead of typed-only coercion for$passwordlib/JIT/Builtin/password lowering — mirror nullable string coercion in JIT/AOT
Repro
./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && php bin/vm.php test/repro/maintainer_gap_password_hash_null.php'
# TypeError (wrong) · Zend: okDone when
-
password_hash(null, …)returns a valid hash on VM/JIT/AOT - Compliance guard under
test/compliance/cases/stdlib/ - php-src-strict; no php-compiler-strict shortcut
Activity
PurHur commentedon Jul 6, 2026
claim: cursor-agent-lane-b — starting this run
Stdlib: password_hash(null) coerces to empty string (#17023) (#17027)
PurHur commentedon Jul 6, 2026
Merged via #17027
Fix:
password_hash()VM usesVmString::coerceStringBuiltinArg()(null →''per ext/standard/password.c Z_PARAM_STR); JIT usesJitStringBuiltinArg::lower()— same pattern ashash_pbkdf2().Verification:
php bin/vm.php test/repro/maintainer_gap_password_hash_null.php→okvendor/bin/phpunit --filter password_hash_null test/compliance/→ OK (6)vendor/bin/phpunit --filter PasswordBuiltinTest→ OK (5)password_hash(null, PASSWORD_BCRYPT)returns bcrypt hash verifying empty password