Fix parse_str error handler use-after-free

NEWS

@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.2.36
 
+- Standard:
+  . Fixed use-after-free in parse_str() when an error handler replaces the
+    result variable. (cataphract)
+
 
 
 21 Oct 2026, PHP 8.2.35

ext/standard/string.c

@@ -4875,6 +4875,7 @@ PHP_FUNCTION(parse_str)
 {
 	char *arg;
 	zval *arrayArg = NULL;
+	zval array;
 	char *res = NULL;
 	size_t arglen;
 
@@ -4883,13 +4884,14 @@ PHP_FUNCTION(parse_str)
 		Z_PARAM_ZVAL(arrayArg)
 	ZEND_PARSE_PARAMETERS_END();
 
-	arrayArg = zend_try_array_init(arrayArg);
-	if (!arrayArg) {
+	if (!zend_try_array_init(arrayArg)) {
 		RETURN_THROWS();
 	}
 
+	array_init(&array);
 	res = estrndup(arg, arglen);
-	sapi_module.treat_data(PARSE_STRING, res, arrayArg);
+	sapi_module.treat_data(PARSE_STRING, res, &array);
+	ZEND_TRY_ASSIGN_REF_VALUE(arrayArg, &array);
 }
 /* }}} */
 

ext/standard/tests/strings/parse_str_error_handler_uaf.phpt

@@ -0,0 +1,30 @@
+--TEST--
+parse_str() remains safe when its error handler replaces the result array
+--INI--
+display_errors=0
+max_input_nesting_level=1
+--FILE--
+<?php
+$result = null;
+$handled = 0;
+
+set_error_handler(function (int $errno, string $message) use (&$result, &$handled): bool {
+    if ($errno === E_WARNING
+        && strpos($message, 'Input variable nesting level exceeded') !== false) {
+        $handled++;
+        $result = null;
+        return true;
+    }
+
+    return false;
+});
+
+parse_str('a[b][c]=1&later=2', $result);
+restore_error_handler();
+
+var_dump($handled);
+echo "done\n";
+?>
+--EXPECT--
+int(1)
+done