[GIT-PULLS] [php-src] PR #22848: Fix GH-22844: StreamPollHandle use-after-free after fclose()
[email protected] (iliaal) Tue, 21 Jul 2026 14:16:21 +0000
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/22848 Author: iliaal `StreamPollHandle` stored the raw `php_stream *` but referenced only the resource container, so `fclose()` freed the stream (via `pefree()`) and cleared `res->ptr`/`res->type` while the handle kept a dangling pointer. isValid(), getStream() and the internal get_fd (reached via `Context::add()`) then dereferenced freed memory. The accessors now re-derive the stream from the held resource and report a closed resource as absent: getStream() returns null, isValid() returns false. A watcher re-derived its registration fd from that same stream in `remove()`, so a watcher removed after its stream closed couldn't recover the fd and left the Poll backend holding the freed watcher, which a reused fd would then write through in `wait()`. It now caches the fd from `add()` and removes by that. Reproduced under ASAN; getStream()'s stub return becomes `resource|null`. Fixes #22844