[php-src] PR #23399: Fix GH-23332: ArrayObject iterator saturation leads to UAF
| From: | luizmenos | Date: | Fri, 21 Aug 2026 12:56:23 +0000 |
| Subject: | [php-src] PR #23399: Fix GH-23332: ArrayObject iterator saturation leads to UAF | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38039@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23399
Author: luizmenos
This fixes https://github.com/php/php-src/issues/23332
Before decrementing the iterator count,
zend_hash_iterator_pos_ex() checked the
overflow state of the wrong hash table. The check used the new hash table (ht), while
the count was decremented on the iterator's current hash table (iter->ht).
When the current hash table's iterator count was saturated, this could make the count
inconsistent and eventually lead to a use-after-free.