[php-src] PR #23813: ext/sqlite3: fix use-after-free when replacing the authorizer from its own callback
| From: | jvoisin | Date: | Mon, 21 Sep 2026 09:42:11 +0000 |
| Subject: | [php-src] PR #23813: ext/sqlite3: fix use-after-free when replacing the authorizer from its own callback | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38656@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23813
Author: jvoisin
SQLite3::setAuthorizer() frees the previously registered authorizer with
zend_fcc_dtor(&db_obj->authorizer_fcc) before installing the new one. The authorizer callback
is invoked during statement preparation with db_obj->in_callback incremented, so calling
setAuthorizer() from inside the authorizer destroys the fcc that is still executing. For a
non-closure callback such as [$obj, 'method'] whose object is only referenced by the fcc,
this releases $this while its method is still on the stack, resulting in a use-after-free (closures
are kept alive by the call frame, method receivers are not).
Reject the call while inside a callback, mirroring the existing guard in SQLite3::close().
createFunction()/createAggregate()/createCollation() append to linked lists and only free their fcc
at database close, so they are not affected.