[php-src] Issue #20656: HashTable use-after-destroy in function table via stream wrapper magic __call() with nested redeclaration

From: Date: Sat, 06 Dec 2025 05:36:13 +0000
Subject: [php-src] Issue #20656: HashTable use-after-destroy in function table via stream wrapper magic __call() with nested redeclaration
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-251355@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/20656 Author: vi3tL0u1s ### Description The following code: ```php <?php class Loader { function stream_open() { return true; } function __call($m, $a) { $map[$obj] = putenv("LA=Gx$g_lang"); function __call($m, $a) {} } } stream_wrapper_register('abc', 'Loader'); require 'abc://'; ``` Resulted in this output: ``` /path/to/php-src/Zend/zend_hash.c(1555) : ht=0x5589df607568 is already destroyed php: /path/to/php-src/Zend/zend_hash.c:73: _zend_is_inconsistent: Assertion `0' failed. Aborted ``` Commit: ``` 824c3891281bb4deb5a1aa245313a6c6b0ea786f ``` Build configuration: ``` CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" LDFLAGS="-fsanitize=address" ./buildconf --force && ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic --enable-mbstring --with-zlib ``` ### PHP Version ```plain PHP 8.6.0-dev (cli) (built: Dec 6 2025 16:29:29) (NTS DEBUG) Copyright (c) The PHP Group Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies ``` ### Operating System Ubuntu 22.04

« previous php.bugs (#251355) next »