[php-src] Issue #20324: zend_objects_destroy_object crashes on NULL EG(current_execute_data) during exception in destructor (zend_objects.c)
| From: | vi3tL0u1s | Date: | Wed, 29 Oct 2025 03:34:53 +0000 |
| Subject: | [php-src] Issue #20324: zend_objects_destroy_object crashes on NULL EG(current_execute_data) during exception in destructor (zend_objects.c) | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-251142@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/20324
Author: vi3tL0u1s
### Description
The following code:
```php
<?php
class a {
function __destruct() {
ob_start(function () use (&$c) {
$c = new A;
!self::$b =$ $x;
}, 1);
$c = new A;
$array = array($c);
header(' ');
print_r($array);
}
}
new a;
```
Resulted in this output:
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==472987==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55a23e17393a bp
0x7ffd7eb42480 sp 0x7ffd7eb42360 T0)
==472987==The signal is caused by a WRITE memory access.
==472987==Hint: address points to the zero page.
```
Commit:
```
336fbf09d77
```
Configuration:
```
CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0"
CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer
--disable-shared --with-pic
```
### PHP Version
```plain
PHP 8.6.0-dev (cli) (built: Oct 29 2025 14:18:41) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies
```
### Operating System
Ubuntu 22.04