[php-src] PR #25302: Fix use-after-free in zend_compile_const_decl() under opcache
| From: | nicolas-grekas | Date: | Sun, 08 Nov 2026 04:32:28 +0000 |
| Subject: | [php-src] PR #25302: Fix use-after-free in zend_compile_const_decl() under opcache | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40420@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25302
Author: nicolas-grekas
zend_compile_const_decl() interns the name of the constant, hands it to the literal of
ZEND_DECLARE_CONST, then registers it as a seen symbol. With opcache, interning at runtime only
finds strings already in shared memory: when the first call misses and another thread or process
caches a script holding the same name before the literal interns it again, the literal swaps in the
shared string and releases the original, which zend_register_seen_symbol() then reads and addrefs.
Registering the symbol first keeps the name referenced while the literal does that.
Found with FrankenPHP: restarting its workers makes them compile the same files concurrently on a
fresh SHM. ASAN:
```
heap-use-after-free in zend_register_seen_symbol zend_compile.c:433, from zend_compile_const_decl
:9484
freed by zend_string_release <- accel_new_interned_string_for_php <- zval_make_interned_string
<- zend_insert_literal <- zend_emit_op <- zend_compile_const_decl :9482
```
No test: this is a race between threads.