[php-src] Issue #22759: Io\Poll use-after-free

[email protected] (iluuu1994) Thu, 16 Jul 2026 10:41:42 +0000
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/22759
Author: iluuu1994

### Description

Originally reported by @P0cas, please credit in test.

The following code:

```php
<?php

[$reader, $writer] = stream_socket_pair(STREAM_PF_UNIX, STREAM_SOCK_STREAM, 0);

$context = new Io\Poll\Context(Io\Poll\Backend::Epoll);
$handle = new StreamPollHandle($reader);

$first = $context->add($handle, [Io\Poll\Event::Read]);
$first->remove();

// Backend registration succeeds, but the Context hash insertion collides
// with $first and its failure is ignored.
$second = $context->add($handle, [Io\Poll\Event::Read]);

// Only $first is invalidated before php_poll_ctx is freed.
unset($context);

// $second still has active=true and the freed php_poll_ctx pointer.
$second->remove();
```

Resulted in this output:
```
==269199==ERROR: AddressSanitizer: heap-use-after-free on address 0x71b5415f3884 at pc 0x5aa806efc8b9 bp 0x7ffdaec76160 sp 0x7ffdaec76158
READ of size 1 at 0x71b5415f3884 thread T0
    #0 0x5aa806efc8b8 in php_poll_remove /home/ilutov/Developer/php-src/main/poll/poll_core.c:282
    #1 0x5aa806be9f56 in zim_Io_Poll_Watcher_remove /home/ilutov/Developer/php-src/ext/standard/io_poll.c:643
```

### PHP Version

```plain
master
```

### Operating System

_No response_