mirror of
https://github.com/php/php-src.git
synced 2026-03-30 04:02:19 +02:00
zend_hash_get_current_key() does not return a string with incremented refcount, so it shouldn't get released. This release caused a UAF later when the attribute was destroyed. This wasn't noticed earlier because object_init_with_constructor() was only ever tested with interned strings. Closes GH-16349.