[php-src] PR #24760: curl: Fix UAF on clone due to callback data pointer mismatch
| From: | ndossche | Date: | Mon, 26 Oct 2026 21:08:01 +0000 |
| Subject: | [php-src] PR #24760: curl: Fix UAF on clone due to callback data pointer mismatch | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39937@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24760
Author: ndossche
When curl opaque objects are cloned, the curl handle was only updated if the callback function
wasn't null. However, the C handler in PHP remains attached even if the callback was set to
NULL (*). So we must unconditionally update the callback data pointer to the new curl handle.
(*) We can't set the C handler to NULL unconditionally on stable branches because that invokes
a behaviour change (e.g. built in progress bar).