[php-src] PR #23221: ext/pcre: preg_replace() use-after-free when __toString() destroys an…
| From: | devnexen | Date: | Tue, 11 Aug 2026 20:53:31 +0000 |
| Subject: | [php-src] PR #23221: ext/pcre: preg_replace() use-after-free when __toString() destroys an… | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37778@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23221
Author: devnexen
… array argument.
Fix #23204
Follow-up on GH-23207.
preg_replace() has a frameless handler, so the pattern, replacement and subject arrays reached
_preg_replace_common() with a refcount of one. Stringifying an entry runs __toString(), which freed
arData under the iterator or rehashed it in place. Taking a reference on each table for the duration
of the read keeps it alive and turns a mutation into a separation.