Repository navigation
Stale EG(opline_before_exception) pointer through eval #20183
Description
Description
Credits to @vi3tL0u1s et al. for the original report.
The following code:
class A {
function __destruct() {
// Store dangling pointer in EG(opline_before_exception)
eval('try { throw new Error(); } catch (Error $e) {}');
debug_print_backtrace();
}
}
B::$b = new A;Resulted in this output:
heap-use-after-free
But I expected this output instead:
#0 %s(10): A->__destruct()
Fatal error: Uncaught Error: Class "B" not found in %s:10
Stack trace:
#0 {main}
thrown in %s on line 10
PHP Version
PHP 8.3
Operating System
No response
Activity
Fix stale EG(opline_before_exception) pointer through eval
Fix stale EG(opline_before_exception) pointer through eval