Niels Dossche
ee0143887d
Fix GH-20352: UAF in php_output_handler_free via re-entrant ob_start() during error deactivation
...
The problem is that the code is doing `php_output_handler_free` in a loop on the output stack,
but prior to freeing the pointer on the stack in `php_output_handler_free` it calls
`php_output_handler_dtor` which can run user code that reallocates the stack,
resulting in a dangling pointer freed by php_output_handler_free.
Furthermore, OG(active) is set when creating a new output handler, but
the loop is supposed to clean up all handlers, so OG(active) must be
reset as well.
Closes GH-20356.
2025-12-19 19:36:26 +01:00
..
2020-01-17 14:52:46 +01:00
2021-06-11 11:57:42 +02:00
2020-08-09 22:03:36 +02:00
2020-08-09 22:03:36 +02:00
2018-10-15 04:33:09 +02:00
2018-10-15 04:33:09 +02:00
2020-02-03 22:52:20 +01:00
2017-08-12 01:37:20 +01:00
2020-01-17 14:52:46 +01:00
2023-07-10 13:24:23 +01:00
2020-06-24 13:13:44 +02:00
2024-07-08 18:37:52 -03:00
2024-08-03 02:05:06 +02:00
2025-12-19 19:36:26 +01:00
2009-06-14 16:47:11 +00:00
2009-06-14 16:47:11 +00:00
2009-06-14 16:47:11 +00:00
2009-06-14 16:47:11 +00:00
2009-06-14 16:47:11 +00:00
2009-06-14 16:47:11 +00:00
2009-06-14 16:47:11 +00:00
2009-06-14 16:47:11 +00:00
2009-06-14 16:47:11 +00:00
2020-02-03 22:52:20 +01:00
2020-07-10 09:32:28 +02:00
2020-02-03 22:52:20 +01:00
2012-05-15 23:09:46 -07:00
2020-09-09 10:47:43 +02:00
2020-09-09 10:47:43 +02:00
2020-02-03 22:52:20 +01:00
2021-06-11 11:57:42 +02:00
2009-06-18 21:03:00 +00:00
2020-06-24 13:13:44 +02:00
2020-06-24 13:13:44 +02:00
2020-06-24 13:13:44 +02:00
2020-06-24 13:13:44 +02:00
2020-06-24 13:13:44 +02:00
2020-06-24 13:13:44 +02:00
2020-06-24 13:13:44 +02:00
2020-06-24 13:13:44 +02:00
2020-06-24 13:13:44 +02:00
2010-05-31 10:29:43 +00:00
2020-06-24 13:13:44 +02:00
2020-06-24 13:13:44 +02:00
2020-06-24 13:13:44 +02:00
2020-02-03 22:52:20 +01:00
2020-02-03 22:52:20 +01:00
2020-06-24 13:13:44 +02:00
2020-06-24 13:13:44 +02:00
2021-09-02 10:37:13 +02:00
2020-02-03 22:52:20 +01:00
2020-02-03 22:52:20 +01:00
2020-02-03 22:52:20 +01:00
2020-02-03 22:52:20 +01:00
2020-02-03 22:52:20 +01:00
2020-08-09 22:03:36 +02:00
2020-06-24 13:13:44 +02:00
2020-07-10 21:05:28 +02:00
2021-09-02 10:37:13 +02:00
2020-07-10 21:05:28 +02:00
2020-06-24 13:13:44 +02:00
2023-07-10 13:24:23 +01:00
2023-07-10 13:24:23 +01:00
2017-02-22 12:31:06 +01:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-07-16 18:36:02 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2023-07-10 13:24:23 +01:00
2023-07-10 13:24:23 +01:00
2023-09-08 13:22:43 +01:00
2020-09-18 14:28:32 +02:00
2020-09-18 14:28:32 +02:00
2019-03-11 11:32:20 +01:00