Niels Dossche b71c6b2c6c Fix #81992: SplFixedArray::setSize() causes use-after-free ...

Upon resizing, the elements are destroyed from lower index to higher
index. When an element refers to an object with a destructor, it can
refer to a lower (i.e. already destroyed) element, causing a uaf.
Set refcounted zvals to NULL after destroying them to avoid a uaf.

Closes GH-11959.

2023-08-14 21:32:22 +02:00

27 KiB

Raw Blame History

View Raw