#
39b8d5c8 |
| 06-Mar-2024 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Fix GH-13612: Corrupted memory in destructor with weak references Inside `zend_object_std_dtor` the weakrefs are notified after the destruction of properties already took place. In this
Fix GH-13612: Corrupted memory in destructor with weak references Inside `zend_object_std_dtor` the weakrefs are notified after the destruction of properties already took place. In this test case, the destructor of an anon class will be invoked due to the property destruction. That class has a weak reference to its parent. This means that the destructor can access parent properties that already have been destroyed, resulting in a UAF. Fix this by notifying the weakrefs at the start of the object's destruction. Closes GH-13613.
show more ...
|