[php-src] Issue #20183: Stale EG(opline_before_exception) pointer through eval
| From: | iluuu1994 | Date: | Wed, 15 Oct 2025 19:18:39 +0000 |
| Subject: | [php-src] Issue #20183: Stale EG(opline_before_exception) pointer through eval | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-251068@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/20183
Author: iluuu1994
### Description
Credits to @vi3tL0u1s et al. for the original report.
The following code:
```php
class A {
function __destruct() {
// Store dangling pointer in EG(opline_before_exception)
eval('try { throw new Error(); } catch (Error $e) {}');
debug_print_backtrace();
}
}
B::$b = new A;
```
Resulted in this output:
```
heap-use-after-free
```
But I expected this output instead:
```
#0 %s(10): A->__destruct()
Fatal error: Uncaught Error: Class "B" not found in %s:10
Stack trace:
#0 {main}
thrown in %s on line 10
```
### PHP Version
```plain
PHP 8.3
```
### Operating System
_No response_