php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4'

Browse Source 
* PHP-8.4:
  Fix use after free during shutdown destruction
This commit is contained in:
Niels Dossche
2025-06-18 21:20:30 +02:00
parent 412d691f54 bb6263af60
commit bc7d00ea6d
2 changed files with 27 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
Zend/tests/gh18833.phpt Normal file
View File

@@ -0,0 +1,24 @@
--TEST--
GH-18833 (Use after free with weakmaps dependent on destruction order)
--FILE--
<?php
class a {
public static WeakMap $map;
public static Generator $storage;
}
a::$map = new WeakMap;
$closure = function () {
$obj = new a;
a::$map[$obj] = true;
yield $obj;
};
a::$storage = $closure();
a::$storage->current();
echo "ok\n";
?>
--EXPECT--
ok

4
Zend/zend_objects_API.c
View File

@@ -100,7 +100,9 @@ ZEND_API void ZEND_FASTCALL zend_objects_store_free_object_storage(zend_objects_
if (IS_OBJ_VALID(obj)) {
if (!(OBJ_FLAGS(obj) & IS_OBJ_FREE_CALLED)) {
GC_ADD_FLAGS(obj, IS_OBJ_FREE_CALLED);
if (obj->handlers->free_obj != zend_object_std_dtor) {
if (obj->handlers->free_obj != zend_object_std_dtor
|| (OBJ_FLAGS(obj) & IS_OBJ_WEAKLY_REFERENCED)
) {
GC_ADDREF(obj);
obj->handlers->free_obj(obj);
}