[php-src] Issue #24712: Use-after-free in foreach by reference when destructor modifies the loop variable

Issue: https://github.com/php/php-src/issues/24712 Author: vi3tL0u1s ### Description The following code: ```php <?php class C { function __destruct() { $GLOBALS['a'] = null; } } $a = new C; foreach ([1] as &$a); ``` Resulted in this output: ``` ================================================================= ==PID==ERROR: AddressSanitizer: heap-use-after-free on address 0x50400006f950 at pc 0x55645e87c8b4 bp 0x7ffe0e02a080 sp 0x7ffe0e02a070 READ of size 4 at 0x50400006f950 thread T0 #0 0x55645e87c8b3 in zend_gc_delref php-src/Zend/zend_types.h:847 #1 0x55645e87db4a in zend_objects_store_del php-src/Zend/zend_objects_API.c:179 #2 0x55645e8d8220 in rc_dtor_func php-src/Zend/zend_variables.c:56 #3 0x55645e5c635c in i_zval_ptr_dtor php-src/Zend/zend_variables.h:44 #4 0x55645e6a772b in ZEND_FE_FETCH_RW_SPEC_VAR_HANDLER php-src/Zend/zend_vm_execute.h:23941 #5 0x55645e7717ec in execute_ex php-src/Zend/zend_vm_execute.h:113564 #6 0x55645e77b05f in zend_execute php-src/Zend/zend_vm_execute.h:116055 #7 0x55645e8f429a in zend_execute_script php-src/Zend/zend.c:1986 #8 0x55645e2e2891 in php_execute_script_ex php-src/main/main.c:2636 #9 0x55645e2e2dee in php_execute_script php-src/main/main.c:2676 #10 0x55645e8fa06c in do_cli php-src/sapi/cli/php_cli.c:941 #11 0x55645e8fc849 in do_php_cli php-src/sapi/cli/php_cli.c:1354 #12 0x55645e8f5124 in main php-src/sapi/cli/php_cli_main.c:18 #13 0x7f9a4d0ead8f (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) #14 0x7f9a4d0eae3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) #15 0x55645d206ef4 in _start (php-src/sapi/cli/php+0x606ef4) 0x50400006f950 is located 0 bytes inside of 40-byte region [0x50400006f950,0x50400006f978) freed by thread T0 here: #0 0x7f9a4d885537 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127 #1 0x55645e4b1f98 in __zend_free php-src/Zend/zend_alloc.c:4097 #2 0x55645e4ab660 in _efree php-src/Zend/zend_alloc.c:3049 #3 0x55645e87df08 in zend_objects_store_del php-src/Zend/zend_objects_API.c:197 #4 0x55645e87f47e in zend_object_release php-src/Zend/zend_objects_API.h:83 #5 0x55645e880af8 in zend_objects_destroy_object php-src/Zend/zend_objects.c:184 #6 0x55645e87db3e in zend_objects_store_del php-src/Zend/zend_objects_API.c:178 #7 0x55645e8d8220 in rc_dtor_func php-src/Zend/zend_variables.c:56 #8 0x55645e5c635c in i_zval_ptr_dtor php-src/Zend/zend_variables.h:44 #9 0x55645e6a772b in ZEND_FE_FETCH_RW_SPEC_VAR_HANDLER php-src/Zend/zend_vm_execute.h:23941 #10 0x55645e7717ec in execute_ex php-src/Zend/zend_vm_execute.h:113564 #11 0x55645e77b05f in zend_execute php-src/Zend/zend_vm_execute.h:116055 #12 0x55645e8f429a in zend_execute_script php-src/Zend/zend.c:1986 #13 0x55645e2e2891 in php_execute_script_ex php-src/main/main.c:2636 #14 0x55645e2e2dee in php_execute_script php-src/main/main.c:2676 #15 0x55645e8fa06c in do_cli php-src/sapi/cli/php_cli.c:941 #16 0x55645e8fc849 in do_php_cli php-src/sapi/cli/php_cli.c:1354 #17 0x55645e8f5124 in main php-src/sapi/cli/php_cli_main.c:18 #18 0x7f9a4d0ead8f (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) previously allocated by thread T0 here: #0 0x7f9a4d885887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 #1 0x55645e4b1c31 in __zend_malloc php-src/Zend/zend_alloc.c:4068 #2 0x55645e4ab581 in _emalloc php-src/Zend/zend_alloc.c:3039 #3 0x55645e880b45 in zend_objects_new php-src/Zend/zend_objects.c:190 #4 0x55645e4c55ed in _object_and_properties_init php-src/Zend/zend_API.c:1894 #5 0x55645e4c57a7 in object_init_ex php-src/Zend/zend_API.c:1917 #6 0x55645e6490db in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER php-src/Zend/zend_vm_execute.h:11442 #7 0x55645e76baa1 in execute_ex php-src/Zend/zend_vm_execute.h:111990 #8 0x55645e77b05f in zend_execute php-src/Zend/zend_vm_execute.h:116055 #9 0x55645e8f429a in zend_execute_script php-src/Zend/zend.c:1986 #10 0x55645e2e2891 in php_execute_script_ex php-src/main/main.c:2636 #11 0x55645e2e2dee in php_execute_script php-src/main/main.c:2676 #12 0x55645e8fa06c in do_cli php-src/sapi/cli/php_cli.c:941 #13 0x55645e8fc849 in do_php_cli php-src/sapi/cli/php_cli.c:1354 #14 0x55645e8f5124 in main php-src/sapi/cli/php_cli_main.c:18 #15 0x7f9a4d0ead8f (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) SUMMARY: AddressSanitizer: heap-use-after-free php-src/Zend/zend_types.h:847 in zend_gc_delref ``` To reproduce: ``` USE_ZEND_ALLOC=0 ./php-src/sapi/cli/php poc.php ``` Commit: ``` 49b2bc4532ec00859256707ac3771657d2889808 ``` Configurations: ``` CC=gcc CFLAGS="-g -O1 -fsanitize=address -fno-omit-frame-pointer" LDFLAGS="-fsanitize=address" \ ./configure --enable-debug --disable-shared --enable-pic --enable-mbstring --with-zlib --without-iconv ``` This bug was found by EyeQ, [Following Dragons: Code Review-Guided Fuzzing](https://arxiv.org/pdf/2602.10487) (to appear at ICSE 2027). ### PHP Version ```plain PHP 8.7.0-dev (cli) (built: Oct 26 2026 10:28:24) (NTS DEBUG) Copyright © The PHP Group and Contributors Zend Engine v4.7.0-dev, Copyright © Zend by Perforce ``` ### Operating System Ubuntu 22.04