1
0
mirror of https://github.com/php/php-src.git synced 2026-04-21 23:18:13 +02:00
Files
archived-php-src/ext
Niels Dossche 7e4a3236d9 Fix GH-12392: Segmentation fault on SoapClient::__getTypes
There are two issues:
- UAF because the hashmap resized while being iterated over, yet the local
  variables used internally in the macros are not updated.
- The hashmap being iterated over is modified: entries are deleted after
  other entries have been added. This causes the deletion to fail sometimes
  because indices of buckets have shifted.

Fix it by using a while loop iteration and HashPosition position tracker
instead.
Issue exists on PHP 8.1 too, but is much harder to trigger.
The test file reproduces the issue reliably on PHP 8.2 and up.

Closes GH-12409.
2023-10-11 17:21:54 +02:00
..
2022-06-25 07:39:55 +01:00
2022-07-27 12:13:32 +02:00
2022-09-13 11:33:09 +01:00
2023-08-19 23:09:22 +01:00
2023-08-17 18:45:10 +01:00
2023-03-27 16:33:36 +02:00
2023-03-27 16:33:36 +02:00
2023-03-01 23:02:03 +01:00
2023-03-27 16:33:36 +02:00