[php-src] Issue #20286: Hash table use-after-destroy in function table during stream wrapper cleanup (Zend/zend_hash.c)
| From: | vi3tL0u1s | Date: | Sat, 25 Oct 2025 06:31:48 +0000 |
| Subject: | [php-src] Issue #20286: Hash table use-after-destroy in function table during stream wrapper cleanup (Zend/zend_hash.c) | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-251115@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/20286
Author: vi3tL0u1s
### Description
The following code:
```php
<?php
class lib {
function stream_open() {
return true;
}
function stream_read($count) {
function a() {}
include('lib://');
}
function stream_close() {
include('lib://');
}
}
stream_wrapper_register('lib', lib::class);
include('lib://test.php');
```
Resulted in this output:
```
/path/to/php-src/Zend/zend_hash.c(2681) : ht=0x7fc36de8e048 is already destroyed
php: /path/to/php-src/Zend/zend_hash.c:73: void _zend_is_inconsistent(const HashTable *, const char
*, int): Assertion `0' failed.
Aborted
```
Commit:
```
7455f6a5b0f
```
Configuration:
```
CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0"
CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer
--disable-shared --with-pic
```
### PHP Version
```plain
PHP 8.6.0-dev (cli) (built: Oct 25 2025 17:19:26) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies
```
### Operating System
Ubuntu 22.04