Use-after-free: class name of an observed static method is released without a reference being taken (#[WithSpan] and hook())

# syntax=docker/dockerfile:1.7
FROM php:8.4-cli-alpine

COPY --from=composer:2 /usr/bin/composer /usr/bin/composer

ARG OTEL_TAG=1.4.0
RUN apk add --no-cache --virtual .build-deps $PHPIZE_DEPS curl tar \
 && curl -sSL "https://github.com/open-telemetry/opentelemetry-php-instrumentation/archive/refs/tags/${OTEL_TAG}.tar.gz" -o /tmp/otel.tgz \
 && tar -xzf /tmp/otel.tgz -C /tmp \
 && cd "/tmp/opentelemetry-php-instrumentation-${OTEL_TAG}/ext" \
 && phpize && ./configure && make -j4 && make install \
 && docker-php-ext-enable opentelemetry \
 && docker-php-ext-install opcache \
 && apk del .build-deps

RUN printf 'opcache.enable_cli=1\nopentelemetry.attr_hooks_enabled=1\n' \
      > /usr/local/etc/php/conf.d/otel.ini

WORKDIR /repro

COPY <<'EOF' /repro/composer.json
{ "require": { "open-telemetry/api": "^1.8" } }
EOF

COPY <<'EOF' /repro/AttrTarget.php
<?php

namespace ReproNs;

use OpenTelemetry\API\Instrumentation\WithSpan;

class AttrTarget
{
    #[WithSpan]
    public static function pingStatic(): int
    {
        return 1;
    }

    #[WithSpan]
    public function pingInstance(): int
    {
        return 1;
    }
}
EOF

COPY <<'EOF' /repro/HookTarget.php
<?php

namespace ReproNs;

class HookTarget
{
    public static function pingStatic(): int
    {
        return 1;
    }

    public function pingInstance(): int
    {
        return 1;
    }
}
EOF

COPY <<'EOF' /repro/attr_static.php
<?php

require __DIR__ . '/vendor/autoload.php';
require __DIR__ . '/AttrTarget.php';

\ReproNs\AttrTarget::pingStatic();
echo "survived\n";
EOF

COPY <<'EOF' /repro/attr_instance.php
<?php

require __DIR__ . '/vendor/autoload.php';
require __DIR__ . '/AttrTarget.php';

(new \ReproNs\AttrTarget())->pingInstance();
echo "survived\n";
EOF

COPY <<'EOF' /repro/hook_static.php
<?php

require __DIR__ . '/vendor/autoload.php';
require __DIR__ . '/HookTarget.php';

\OpenTelemetry\Instrumentation\hook(
    \ReproNs\HookTarget::class,
    'pingStatic',
    pre: static function (mixed $target, array $params, ?string $class, string $function): void {},
    post: static function (): void {},
);

\ReproNs\HookTarget::pingStatic();
echo "survived\n";
EOF

COPY <<'EOF' /repro/hook_instance.php
<?php

require __DIR__ . '/vendor/autoload.php';
require __DIR__ . '/HookTarget.php';

\OpenTelemetry\Instrumentation\hook(
    \ReproNs\HookTarget::class,
    'pingInstance',
    pre: static function (mixed $target, array $params, ?string $class, string $function): void {},
    post: static function (): void {},
);

(new \ReproNs\HookTarget())->pingInstance();
echo "survived\n";
EOF

# Both the declaring file and the calling file. Leaving the caller out lets the literal
# class name there be interned, which hides the fault.
COPY <<'EOF' /repro/blacklist.txt
/repro/AttrTarget.php
/repro/HookTarget.php
/repro/attr_static.php
/repro/attr_instance.php
/repro/hook_static.php
/repro/hook_instance.php
EOF

RUN composer install --no-interaction --quiet

COPY <<'EOF' /usr/local/bin/repro
#!/bin/sh
printf 'PHP %s, ext-opentelemetry %s\n\n' \
    "$(php -r 'echo PHP_VERSION;')" "$(php -r 'echo phpversion("opentelemetry");')"

run() {
    label=$1
    script=$2
    interned=$3

    if [ "$interned" = "yes" ]; then
        USE_ZEND_ALLOC=0 php "/repro/$script" > /dev/null 2>&1
    else
        USE_ZEND_ALLOC=0 php -d opcache.blacklist_filename=/repro/blacklist.txt "/repro/$script" > /dev/null 2>&1
    fi

    code=$?
    if [ "$code" -eq 0 ]; then
        result="survived"
    else
        result="CRASHED"
    fi
    printf '%-28s class name interned: %-3s  exit=%-4s %s\n' "$label" "$interned" "$code" "$result"
}

run '#[WithSpan] static'  attr_static.php   yes
run '#[WithSpan] static'  attr_static.php   no
run 'hook() static'       hook_static.php   yes
run 'hook() static'       hook_static.php   no
printf '\ncontrols, same conditions but not static:\n'
run '#[WithSpan] instance' attr_instance.php no
run 'hook() instance'      hook_instance.php no
EOF

RUN chmod +x /usr/local/bin/repro

ENTRYPOINT ["/usr/local/bin/repro"]

Build another version with --build-arg OTEL_TAG=1.2.1.