[php-src] PR #23813: ext/sqlite3: fix use-after-free when replacing the authorizer from its own callback

From: Date: Mon, 21 Sep 2026 09:42:11 +0000
Subject: [php-src] PR #23813: ext/sqlite3: fix use-after-free when replacing the authorizer from its own callback
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-38656@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/23813 Author: jvoisin SQLite3::setAuthorizer() frees the previously registered authorizer with zend_fcc_dtor(&db_obj->authorizer_fcc) before installing the new one. The authorizer callback is invoked during statement preparation with db_obj->in_callback incremented, so calling setAuthorizer() from inside the authorizer destroys the fcc that is still executing. For a non-closure callback such as [$obj, 'method'] whose object is only referenced by the fcc, this releases $this while its method is still on the stack, resulting in a use-after-free (closures are kept alive by the call frame, method receivers are not). Reject the call while inside a callback, mirroring the existing guard in SQLite3::close(). createFunction()/createAggregate()/createCollation() append to linked lists and only free their fcc at database close, so they are not affected.

« previous php.git-pulls (#38656) next »