[php-src] PR #23388: ext/spl: SplDoublyLinkedList::serialize() use-after-free on element r…
| From: | devnexen | Date: | Wed, 19 Aug 2026 18:18:58 +0000 |
| Subject: | [php-src] PR #23388: ext/spl: SplDoublyLinkedList::serialize() use-after-free on element r… | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38020@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23388
Author: devnexen
…emoval.
Fix #23385
The serialization loop passed php_var_serialize() a pointer into the list element itself, so a
userland __serialize() unsetting that entry freed both the element and its payload while the
serializer was still walking them. Serialize a copy of the element data instead, which outlives the
callback.