1
0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Files
archived-php-src/tests/output
Niels Dossche ee0143887d Fix GH-20352: UAF in php_output_handler_free via re-entrant ob_start() during error deactivation
The problem is that the code is doing `php_output_handler_free` in a loop on the output stack,
but prior to freeing the pointer on the stack in `php_output_handler_free` it calls
`php_output_handler_dtor` which can run user code that reallocates the stack,
resulting in a dangling pointer freed by php_output_handler_free.
Furthermore, OG(active) is set when creating a new output handler, but
the loop is supposed to clean up all handlers, so OG(active) must be
reset as well.

Closes GH-20356.
2025-12-19 19:36:26 +01:00
..
2020-02-03 22:52:20 +01:00
2020-02-03 22:52:20 +01:00
2020-02-03 22:52:20 +01:00
2012-05-15 23:09:46 -07:00
2020-02-03 22:52:20 +01:00
2020-02-03 22:52:20 +01:00
2020-02-03 22:52:20 +01:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00