Skip to content

Fix use-after-free in ArrayObject::unset() with destructor - #16653

Closed
iluuu1994 wants to merge 2 commits into
php:PHP-8.2from
iluuu1994:gh-16646
Closed

iluuu1994 wants to merge 2 commits into
php:PHP-8.2from
iluuu1994:gh-16646

Conversation

@iluuu1994

Copy link
Copy Markdown
Member

Fixes GH-16646

@iluuu1994

Copy link
Copy Markdown
Member Author

There are also some more issues with ArrayObject::exchangeArray(). I'll look at those while I'm at it.

@ndossche

Copy link
Copy Markdown
Member

I didnt properly check when I wrote my comment that we could simply delay destructors, but indeed this seems to work too in this case.

@Girgias Girgias left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

global and $GLOBALS do be the bane of my existence with all the whack bugs it can create.

But this looks reasonable

@iluuu1994

Copy link
Copy Markdown
Member Author

Along with references, error handlers and destructors. ^^ Unfortunately, they are also kind of useful. 😄

@Girgias

Girgias commented Oct 31, 2024

Copy link
Copy Markdown
Member

Very true :')

@iluuu1994 iluuu1994 closed this in 8910ac8 Nov 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants