[php-src] PR #25132: openssl: Fix use-after-free in TLS session remove callback
| From: | bukka | Date: | Sun, 01 Nov 2026 17:45:43 +0000 |
| Subject: | [php-src] PR #25132: openssl: Fix use-after-free in TLS session remove callback | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40194@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25132
Author: bukka
The session remove callback reads the listener stream from the SSL_CTX ex_data, but the context is
shared with accepted connections and can outlive the listener. Closing the listener left a dangling
pointer that the callback later dereferenced. Clear it on close when it refers to the stream being
freed.
The added test reproduces it via a TCP proxy and crashes under ASan without the fix.