[php-src] PR #25273: Fix GH-25263: Use-after-free of __call trampoline when cloning CurlHandle
| From: | lazerg | Date: | Sat, 07 Nov 2026 09:50:25 +0000 |
| Subject: | [php-src] PR #25273: Fix GH-25263: Use-after-free of __call trampoline when cloning CurlHandle | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40380@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25273
Author: lazerg
When a callback is a
__call trampoline, zend_fcc_addref() moves it into a
heap copy that the handle's FCC owns. Cloning the handle used zend_fcc_dup(),
which only copies the pointer, so both handles shared that one copy: freeing the first handle freed
it, and the second one then used it after free and freed it again. The clone now gets its own copy
of the trampoline, the same way zend_call_known_fcc() does it.
Fixes GH-25263