Fix GH-23332: HashTable iterator counter loses its saturation

NEWS

@@ -26,6 +26,8 @@ PHP                                                                        NEWS
   . Fixed bug GH-25311 (Assertion ret == SUCCESS in array_map()/array_filter()
     after delayed out-of-memory). (ndossche)
   . Fixed AST export of by-reference property hooks. (Jorg Sowa)
+  . Fixed bug GH-23332 (Saturation of the HashTable iterator counter leads to
+    UAF). (luizmenos, Ilia Alshanetsky)
 
 - Curl:
   . Fixed curl_reset() retaining CURLOPT_PRIVATE after reset. (lacatoire)

Zend/tests/gh23332.phpt

@@ -0,0 +1,45 @@
+--TEST--
+GH-23332 (Saturation of the HashTable iterator counter leads to UAF)
+--FILE--
+<?php
+function gen(array &$a) {
+    foreach ($a as &$v) {
+        yield;
+    }
+}
+
+$a = ['first' => 1, 'second' => 2, 'third' => 3];
+
+// Saturate $a's iterator counter (it caps at 255).
+$gens = [];
+for ($i = 0; $i < 255; $i++) {
+    $g = gen($a);
+    $g->current();
+    $gens[] = $g;
+}
+unset($g);
+
+$array = $a;
+
+$pass = 0;
+$retained = null;
+foreach ($array as $key => &$value) {
+    echo "pass ", ++$pass, ": $key => $value\n";
+    if ($pass === 1) {
+        $retained = $array;
+        $array = ['replacement' => 4242];
+        continue;
+    }
+    for ($i = 0; $i < 254; $i++) {
+        unset($gens[$i]);
+    }
+    $retained = null;
+    unset($gens[254]);
+}
+
+echo "done\n";
+?>
+--EXPECT--
+pass 1: first => 1
+pass 2: replacement => 4242
+done

Zend/zend_hash.c

@@ -787,7 +787,7 @@ ZEND_API HashPosition ZEND_FASTCALL zend_hash_iterator_pos_ex(uint32_t idx, zval
 	ZEND_ASSERT(idx != (uint32_t)-1);
 	if (UNEXPECTED(iter->ht != ht) && !zend_hash_iterator_find_copy_pos(idx, ht)) {
 		if (EXPECTED(iter->ht) && EXPECTED(iter->ht != HT_POISONED_PTR)
-				&& EXPECTED(!HT_ITERATORS_OVERFLOW(ht))) {
+				&& EXPECTED(!HT_ITERATORS_OVERFLOW(iter->ht))) {
 			HT_DEC_ITERATORS_COUNT(iter->ht);
 		}