[php-src] PR #25278: Fix GH-24430: Check for user frame before reading opline in generator dtor

From: Date: Sat, 07 Nov 2026 11:05:54 +0000
Subject: [php-src] PR #25278: Fix GH-24430: Check for user frame before reading opline in generator dtor
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-40385@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/25278 Author: prateekbhujel Fixes GH-24430 When zend_generator_dtor_storage() executes a generator's finally block while EG(exception) is already set (for example, when an earlier generator's finally block threw during gc_collect_cycles() inside a fiber), EG(current_execute_data) is the gc_destructor_fiber() internal function frame. Because zend_vm_init_call_frame() does not initialize call->opline for internal function frames, EG(current_execute_data)->opline contains uninitialized stack memory when the fiber VM stack page is allocated from dirty heap memory or under AddressSanitizer. Reading EG(current_execute_data)->opline->opcode without first checking EG(current_execute_data)->func && ZEND_USER_CODE(EG(current_execute_data)->func->common.type) then dereferences an uninitialized pointer. Guard the opline check with EG(current_execute_data)->func && ZEND_USER_CODE(EG(current_execute_data)->func->common.type), matching is_handle_exception_set() in Zend/zend_exceptions.c. cc @alexandre-daubois @iluuu1994

« previous php.git-pulls (#40385) next »