[php-src] Issue #21927: Use-after-free of self-freeing MultipleIterator children
[email protected] (iluuu1994)
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <lIn3mqU8vxNtGQWuqWJaZQeRsNek8NKBhnRvgWmX5k4@main.internal.php.net> |
Issue: https://github.com/php/php-src/issues/21927
Author: iluuu1994
### Description
Originally reported by @flex0geek.
The following code:
```php
<?php
class FreeSelfOnRewind implements Iterator {
public function __construct(private MultipleIterator $parent) {}
public function rewind(): void {
$this->parent->detachIterator($this);
var_dump($this);
}
public function current(): mixed { return 0; }
public function key(): mixed { return 0; }
public function next(): void {}
public function valid(): bool { return false; }
}
$mi = new MultipleIterator();
$mi->attachIterator(new FreeSelfOnRewind($mi));
$mi->rewind();
```
Resulted in this output:
```
Use-after-free
```
The same goes for various other `MultipleIterator` methods that call methods on the child iterator without addref.
### PHP Version
```plain
8.4+
```
### Operating System
_No response_