[php-src] PR #24710: Fix GH-24701: Use-after-free on typed trait constants during opcache preload
| From: | lazerg | Date: | Mon, 26 Oct 2026 01:06:39 +0000 |
| Subject: | [php-src] PR #24710: Fix GH-24701: Use-after-free on typed trait constants during opcache preload | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39886@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24710
Author: lazerg
zend_do_traits_constant_binding() copies the trait constant into the using class but
doesn't take a reference on its type, so both constants share the same class name string.
During preload that string isn't interned yet, and when opcache interns it for the first
constant it frees the original while the second still points to it. Now the copy goes through
zend_type_copy_ctor(), same as the trait property path. A union type also shared the
type list, which trips an assertion in debug builds, so the test covers both.
Based on the reporter's suggested fix.
Fixes #24701