[php-src] PR #23731: Fix GH-23725: use-after-free when __toString() frees a frameless argument
| From: | iliaal | Date: | Thu, 17 Sep 2026 18:04:02 +0000 |
| Subject: | [php-src] PR #23731: Fix GH-23725: use-after-free when __toString() frees a frameless argument | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38536@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23731
Author: iliaal
Frameless calls hand the handler the caller's operand zvals without taking a reference, so an
argument freed by a __toString() the handler triggers leaves it reading freed memory. Taking the
reference in the Z_FLF_PARAM_ARRAY macros generalizes the per-function guards from 8ce7f7f5e93, as
suggested on php/php-src#23221, which this supersedes. Z_FLF_PARAM_STR still reads its string
directly on the fast path, so GH-21639 stays open.
Fixes php/php-src#23725