[php-src] Issue #20656: HashTable use-after-destroy in function table via stream wrapper magic __call() with nested redeclaration
[email protected] (vi3tL0u1s)
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Issue: https://github.com/php/php-src/issues/20656
Author: vi3tL0u1s
### Description
The following code:
```php
<?php
class Loader {
function stream_open() {
return true;
}
function __call($m, $a) {
$map[$obj] = putenv("LA=Gx$g_lang");
function __call($m, $a) {}
}
}
stream_wrapper_register('abc', 'Loader');
require 'abc://';
```
Resulted in this output:
```
/path/to/php-src/Zend/zend_hash.c(1555) : ht=0x5589df607568 is already destroyed
php: /path/to/php-src/Zend/zend_hash.c:73: _zend_is_inconsistent: Assertion `0' failed.
Aborted
```
Commit:
```
824c3891281bb4deb5a1aa245313a6c6b0ea786f
```
Build configuration:
```
CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" LDFLAGS="-fsanitize=address" ./buildconf --force && ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic --enable-mbstring --with-zlib
```
### PHP Version
```plain
PHP 8.6.0-dev (cli) (built: Dec 6 2025 16:29:29) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies
```
### Operating System
Ubuntu 22.04