Heap use-after-free in phpdbg (zend_hash.c:57 in _zend_is_inconsistent)

The following code:

<?php
header_register_callback(function() { echo "sent";});
$a = [0];
$a[0] = 1;
$b = &$a;
$a[0] = 2;
$a[1] = 3;
$c = [1];
$b = &$c;
?>

Resulted in this output:

Segmentation fault (core dumped)

To reproduce:

phpdbg ./test.php
> b 4
> r
> w $a[0]
> w r $b
> c
> q

(I guess the bug for phpdbg might not be exploitable? so I make it public)

PHP 8.4.0-dev

ubuntu 22.04

Thanks I ll try to have a look within the next days both phpdbg issues.

Fix GH-15210: phpdbg_print_changed_zvals working on a real copy instead.

Navigation Menu