Repository navigation
Segmentation fault in Zend/zend_object_handlers.c #16040
Description
Description
The following code:
<?php
set_error_handler(function($code, $msg) {
$GLOBALS['a']=8;
});
trait Foo {
public string $bar {
get => $fusion->getBar();
}
}
class A {
use Foo;
}
$a = new A();
var_dump($a->bar);Resulted in this output:
/php-src/Zend/zend_object_handlers.c:829:7: runtime error: member access within misaligned address 0xffffffffffffffff for type 'const zend_object_handlers' (aka 'const struct _zend_object_handlers'), which requires 8 byte alignment
0xffffffffffffffff: note: pointer points here
<memory cannot be printed>
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/Zend/zend_object_handlers.c:829:7 in
PHP Version
PHP 8.4.0-dev
Operating System
ubuntu 22.04
Activity
DanielEScherzer commentedon Sep 25, 2024
Minimal reproduction (though the address changes, original address can be produced by moving the property hook into a trait)
Fix use-after-free of object released in hook