[php-src] PR #24714: Fix GH-24712: Use-after-free in foreach by reference with destructor
| From: | lazerg | Date: | Mon, 26 Oct 2026 04:11:43 +0000 |
| Subject: | [php-src] PR #24714: Fix GH-24712: Use-after-free in foreach by reference with destructor | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39889@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24714
Author: lazerg
FE_FETCH_RW released the old value of the loop variable before binding the reference to
it. If that value is an object whose destructor writes to the same variable, the destructor sees the
half-released object still in the slot, and the write frees it a second time. The reference is now
stored first and the old value released afterwards, the same way ASSIGN_REF does it.
Fixes #24712