Bug #72530 [Com]: Use After Free in GC with Certain Destructors

Edit report at https://bugs.php.net/bug.php?id=72530&edit=1 ID: 72530 Comment by: ben at redsnapper dot net Reported by: taoguangchen at icloud dot com Summary: Use After Free in GC with Certain Destructors Status: Closed Type: Bug Package: *General Issues PHP Version: 5.6.29 Assigned To: dmitry Block user comment: N Private report: N New Comment: Why is there no CVE attached to this? disable_functions is a complete waste of time until this is patched. Previous Comments: ------------------------------------------------------------------------ [2019-11-09 17:22:32] asdaaa at gmail dot com The following patch has been added/updated: Patch Name: alfa Revision: 1573320152 URL: https://bugs.php.net/patch-display.php?bug=72530&patch=alfa&revision=1573320152 ------------------------------------------------------------------------ [2019-10-06 07:45:28] alexanderpas at gmail dot com This bug is publicly referenced as the cause in the following exploit bypassing disable_functions() https://github.com/mm0r1/exploits/tree/master/php7-gc-bypass ------------------------------------------------------------------------ [2019-08-13 12:55:04] nikic@php.net Automatic comment on behalf of nikita.ppv@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=60a7e60b61b8e4a3d455974c83f76a26546ce117 Log: Fixed bug #72530 ------------------------------------------------------------------------ [2019-08-13 12:54:33] nikic@php.net Automatic comment on behalf of nikita.ppv@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=60a7e60b61b8e4a3d455974c83f76a26546ce117 Log: Fixed bug #72530 ------------------------------------------------------------------------ [2019-08-01 11:02:44] nikic@php.net The following pull request has been associated: Patch Name: Fix handling of destructors during GC On GitHub: https://github.com/php/php-src/pull/4489 Patch: https://github.com/php/php-src/pull/4489.patch ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=72530 -- Edit this bug report at https://bugs.php.net/bug.php?id=72530&edit=1