[php-src] PR #23458: fix: move error finalization after stream fields in stream_get_meta_data to prevent UAF
| From: | shoemoney | Date: | Tue, 25 Aug 2026 17:58:07 +0000 |
| Subject: | [php-src] PR #23458: fix: move error finalization after stream fields in stream_get_meta_data to prevent UAF | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38137@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23458
Author: shoemoney
Fixes heap-use-after-free in stream_get_meta_data.
php_stream_error_operation_end_for_stream invokes the error handler which may fclose the stream. In
the previous order this ran before wrapperdata, wrapper type, stream type, mode and uri were copied
into the return value, so those reads touched freed memory. Deferring finalization until after all
stream fields are copied closes the UAF window.
The change is a one-line reorder within PHP_FUNCTION(stream_get_meta_data). It keeps begin, populate
and eof handling unchanged and only moves the end call after the last stream field access. This
matches the pattern needed for the sibling reports 23259 and 23264 which share the same root cause.
Written in conjunction with my pair programmer Claude.