[php-src] Issue #20183: Stale EG(opline_before_exception) pointer through eval

From: Date: Wed, 15 Oct 2025 19:18:39 +0000
Subject: [php-src] Issue #20183: Stale EG(opline_before_exception) pointer through eval
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-251068@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/20183 Author: iluuu1994 ### Description Credits to @vi3tL0u1s et al. for the original report. The following code: ```php class A { function __destruct() { // Store dangling pointer in EG(opline_before_exception) eval('try { throw new Error(); } catch (Error $e) {}'); debug_print_backtrace(); } } B::$b = new A; ``` Resulted in this output: ``` heap-use-after-free ``` But I expected this output instead: ``` #0 %s(10): A->__destruct() Fatal error: Uncaught Error: Class "B" not found in %s:10 Stack trace: #0 {main} thrown in %s on line 10 ``` ### PHP Version ```plain PHP 8.3 ``` ### Operating System _No response_

« previous php.bugs (#251068) next »