[php-src] PR #24693: Fix GH-24674: var_destroy(): hold serialize_lock around deferred destructor pass
| From: | HoneyTyagii | Date: | Sun, 25 Oct 2026 16:12:40 +0000 |
| Subject: | [php-src] PR #24693: Fix GH-24674: var_destroy(): hold serialize_lock around deferred destructor pass | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39869@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24693
Author: HoneyTyagii
Fixes #24674.
The same use-after-free as GH-24481 is reachable through entry points that
create their own var_hash context, such as SplObjectStorage::__unserialize()
(and SplDoublyLinkedList/ArrayObject). var_destroy() frees the var_entries
chain before running the deferred destructor pass; a destructor that calls
unserialize() could reuse the freed chunks. Holding BG(serialize_lock)
around i_zval_ptr_dtor() prevents re-entrancy from reusing the chain being
destroyed.