[php-src] PR #24538: Fix GH-24532: Reset unserialize var entries before running destructors
| From: | lazerg | Date: | Thu, 22 Oct 2026 13:38:03 +0000 |
| Subject: | [php-src] PR #24538: Fix GH-24532: Reset unserialize var entries before running destructors | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39701@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24538
Author: lazerg
var_destroy() frees the extra var_entries blocks but leaves
last and entries.next pointing at them, and only then releases the dtor
values. If one of those destructors calls unserialize(), the nested call shares the
context that is being torn down and pushes into freed memory. The context is now reset to its
embedded block before the destructors run, and any block a nested call allocates there is freed at
the end.
This only hardens the shared context. GH-21824 / #21828 covers not sharing it during cleanup at all.
Fixes GH-24532