[php-src] Issue #24455: Lazy object reset with object destructor can lead to use-after-free

From: Date: Tue, 20 Oct 2026 08:16:55 +0000
Subject: [php-src] Issue #24455: Lazy object reset with object destructor can lead to use-after-free
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-253044@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/24455 Author: alexandre-daubois ### Description _Originally reported by @cnwangjihe._ The re-entrant property destruction issue reported in #22399 also affects ReflectionClass::resetAsLazyGhost() and ReflectionClass::resetAsLazyProxy(). The following code: ```php <?php class Target { public ?Trigger $trigger = null; } class Trigger { public function __construct(private object $target) {} public function __destruct() { unset($this->target->trigger); } } $reflection = new ReflectionClass(Target::class); $target = new Target(); $target->trigger = new Trigger($target); $reflection->resetAsLazyGhost($target, static function (): void {}); ``` Resulted in this output: ``` ERROR: AddressSanitizer: heap-use-after-free zend_object_make_lazy Zend/zend_lazy_objects.c:338 ``` But I expected this output instead: ``` ``` ### PHP Version ```plain PHP 8.4+ ``` ### Operating System _No response_

« previous php.bugs (#253044) next »