Skip to content

Fix use-after-free when a string offset warning releases the string - #25329

Closed
jorgsowa wants to merge 2 commits into
php:PHP-8.4from
jorgsowa:fix-string-offset-warning-uaf
Closed

jorgsowa wants to merge 2 commits into
php:PHP-8.4from
jorgsowa:fix-string-offset-warning-uaf

Conversation

@jorgsowa

@jorgsowa jorgsowa commented Nov 8, 2026

Copy link
Copy Markdown
Contributor

The error handler may release the container string while the "Illegal string offset" warning (VM read) or the undefined offset warning (JIT FETCH_DIM_IS) is raised. Hold a reference across the warning, like the other string offset warnings already do.

Follow-up of https://github.com/php/php-src/pull/25298/files#r4506797067

Comment thread NEWS Resolved
The error handler may release the container string while the
"Illegal string offset" warning (VM read) or the undefined offset
warning (JIT FETCH_DIM_IS) is raised. Hold a reference across the
warning, like the other string offset warnings already do.
@jorgsowa
jorgsowa force-pushed the fix-string-offset-warning-uaf branch from c621f5a to c73ecee Compare November 9, 2026 21:32
@jorgsowa jorgsowa closed this in febae1c Nov 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants