[php-src] Issue #20286: Hash table use-after-destroy in function table during stream wrapper cleanup (Zend/zend_hash.c)

From: Date: Sat, 25 Oct 2025 06:31:48 +0000
Subject: [php-src] Issue #20286: Hash table use-after-destroy in function table during stream wrapper cleanup (Zend/zend_hash.c)
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-251115@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/20286 Author: vi3tL0u1s ### Description The following code: ```php <?php class lib { function stream_open() { return true; } function stream_read($count) { function a() {} include('lib://'); } function stream_close() { include('lib://'); } } stream_wrapper_register('lib', lib::class); include('lib://test.php'); ``` Resulted in this output: ``` /path/to/php-src/Zend/zend_hash.c(2681) : ht=0x7fc36de8e048 is already destroyed php: /path/to/php-src/Zend/zend_hash.c:73: void _zend_is_inconsistent(const HashTable *, const char *, int): Assertion `0' failed. Aborted ``` Commit: ``` 7455f6a5b0f ``` Configuration: ``` CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic ``` ### PHP Version ```plain PHP 8.6.0-dev (cli) (built: Oct 25 2025 17:19:26) (NTS DEBUG) Copyright (c) The PHP Group Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies ``` ### Operating System Ubuntu 22.04

« previous php.bugs (#251115) next »