Niels Dossche b71c6b2c6c
Fix #81992 : SplFixedArray::setSize() causes use-after-free ...
Upon resizing, the elements are destroyed from lower index to higher
index. When an element refers to an object with a destructor, it can
refer to a lower (i.e. already destroyed) element, causing a uaf.
Set refcounted zvals to NULL after destroying them to avoid a uaf.
Closes GH-11959.
2023-08-14 21:32:22 +02:00
2022-06-25 07:39:55 +01:00
2022-06-18 11:50:14 +02:00
2023-08-10 15:51:53 +02:00
2023-08-09 15:39:13 +01:00
2022-07-27 12:13:32 +02:00
2023-08-08 20:06:39 +02:00
2023-05-12 23:37:00 +02:00
2023-07-21 10:42:19 +02:00
2023-07-01 17:58:38 +02:00
2022-10-27 14:39:43 +01:00
2023-07-07 17:55:53 +02:00
2023-07-06 21:39:40 +02:00
2022-09-13 11:33:09 +01:00
2023-07-18 19:21:13 +02:00
2023-07-10 13:29:49 +02:00
2023-07-27 12:29:49 +02:00
2023-05-13 18:41:33 +01:00
2022-12-16 14:36:30 +01:00
2023-07-31 19:53:43 +01:00
2023-07-01 21:55:21 +02:00
2023-08-04 22:25:01 +01:00
2023-08-10 15:23:54 +01:00
2023-03-27 16:33:36 +02:00
2023-08-08 08:52:41 +02:00
2023-07-31 20:00:31 +02:00
2023-06-09 16:49:09 +01:00
2023-08-03 21:48:34 +02:00
2023-06-22 23:13:37 +02:00
2023-07-17 07:08:45 +01:00
2022-08-26 14:59:08 +02:00
2023-03-27 21:01:06 +02:00
2023-08-04 22:25:01 +01:00
2023-03-27 16:33:36 +02:00
2023-03-15 21:36:50 +01:00
2022-09-05 17:26:13 +02:00
2023-06-22 20:49:00 +02:00
2023-06-18 13:44:39 +01:00
2023-08-04 21:08:39 +02:00
2023-01-02 16:54:47 +00:00
2023-05-26 11:39:22 +02:00
2023-07-11 17:38:09 +02:00
2023-06-22 12:35:55 +02:00
2023-07-31 20:01:03 -05:00
2023-07-31 19:53:43 +01:00
2023-03-29 19:44:30 +02:00
2023-08-14 21:32:22 +02:00
2023-07-07 10:24:54 +02:00
2023-08-10 15:51:53 +02:00
2023-03-01 23:02:03 +01:00
2023-03-27 16:33:36 +02:00
2022-10-27 14:39:43 +01:00
2023-07-31 19:53:43 +01:00
2023-07-31 20:01:03 -05:00
2023-01-15 15:34:43 +00:00
2023-07-31 19:53:43 +01:00
2023-08-01 11:41:13 +02:00
2023-05-01 15:28:59 +02:00
2023-02-23 18:47:26 +00:00
b71c6b2c6c