History log of /PHP-8.4/Zend/tests/weakrefs/gh13612.phpt (Results 1 – 1 of 1)
Revision Date Author Comments
# 39b8d5c8 06-Mar-2024 Niels Dossche <7771979+nielsdos@users.noreply.github.com>

Fix GH-13612: Corrupted memory in destructor with weak references

Inside `zend_object_std_dtor` the weakrefs are notified after the destruction
of properties already took place. In this

Fix GH-13612: Corrupted memory in destructor with weak references

Inside `zend_object_std_dtor` the weakrefs are notified after the destruction
of properties already took place. In this test case, the destructor of an anon
class will be invoked due to the property destruction. That class has a
weak reference to its parent. This means that the destructor can access
parent properties that already have been destroyed, resulting in a UAF.
Fix this by notifying the weakrefs at the start of the object's
destruction.

Closes GH-13613.

show more ...