[php-src] Issue #8438: HashTableIterators of empty hashtables are not poisoned upon destruction
| From: | bwoebi | Date: | Wed, 27 Apr 2022 04:46:33 +0000 |
| Subject: | [php-src] Issue #8438: HashTableIterators of empty hashtables are not poisoned upon destruction | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-241272@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/8438
Comment Author: bwoebi
As it is right now, we always seem to route user-controlled arrays through
zend_array_destroy which doesn't expose this problem.
zend_array_destroy always properly releases its iterators.
zend_hash_destroy does not, if nNumUsed == 0.
foreach would be only impacted if we were to remove it from
zend_array_destroy too.