[php-src] PR #23252: Fix HashTable UAF when rebound from a parameter __toString()
| From: | iliaal | Date: | Thu, 13 Aug 2026 15:47:15 +0000 |
| Subject: | [php-src] PR #23252: Fix HashTable UAF when rebound from a parameter __toString() | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37826@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23252
Author: iliaal
dispatch_param_event walks bound_params with ZEND_HASH_FOREACH while sqlite's EXEC_PRE hook can
run __toString. From there execute() frees the table and bindValue() replaces buckets. This steals
one _reserved bit as in_param_event (no layout size change; the header is installed) and throws
Error from bind/execute/closeCursor while the hook is running. 8.5/master already have a refactored
uint16_t bitfield with in_fetch; the forward merge needs in_param_event:1 and reserved:11.