[php-src] Issue #21927: Use-after-free of self-freeing MultipleIterator children

[email protected] (iluuu1994)
Newsgroups php.bugs
Message-ID <lIn3mqU8vxNtGQWuqWJaZQeRsNek8NKBhnRvgWmX5k4@main.internal.php.net>
Issue: https://github.com/php/php-src/issues/21927
Author: iluuu1994

### Description

Originally reported by @flex0geek.

The following code:

```php
<?php

class FreeSelfOnRewind implements Iterator {
    public function __construct(private MultipleIterator $parent) {}

    public function rewind(): void {
        $this->parent->detachIterator($this);
        var_dump($this);
    }

    public function current(): mixed { return 0; }
    public function key(): mixed { return 0; }
    public function next(): void {}
    public function valid(): bool { return false; }
}

$mi = new MultipleIterator();
$mi->attachIterator(new FreeSelfOnRewind($mi));
$mi->rewind();
```

Resulted in this output:
```
Use-after-free
```

The same goes for various other `MultipleIterator` methods that call methods on the child iterator without addref.

### PHP Version

```plain
8.4+
```

### Operating System

_No response_
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.