[php-src] Issue #24455: Lazy object reset with object destructor can lead to use-after-free
| From: | alexandre-daubois | Date: | Tue, 20 Oct 2026 08:16:55 +0000 |
| Subject: | [php-src] Issue #24455: Lazy object reset with object destructor can lead to use-after-free | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-253044@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/24455
Author: alexandre-daubois
### Description
_Originally reported by @cnwangjihe._
The re-entrant property destruction issue reported in #22399 also affects
ReflectionClass::resetAsLazyGhost() and
ReflectionClass::resetAsLazyProxy().
The following code:
```php
<?php
class Target {
public ?Trigger $trigger = null;
}
class Trigger {
public function __construct(private object $target) {}
public function __destruct() {
unset($this->target->trigger);
}
}
$reflection = new ReflectionClass(Target::class);
$target = new Target();
$target->trigger = new Trigger($target);
$reflection->resetAsLazyGhost($target, static function (): void {});
```
Resulted in this output:
```
ERROR: AddressSanitizer: heap-use-after-free
zend_object_make_lazy Zend/zend_lazy_objects.c:338
```
But I expected this output instead:
```
```
### PHP Version
```plain
PHP 8.4+
```
### Operating System
_No response_