[GIT-PULLS] [php-src] PR #23252: Fix HashTable UAF when rebound from a parameter __toString()

[email protected] (iliaal)
Newsgroups php.git-pulls
Message-ID <[email protected]> 
Pull Request: https://github.com/php/php-src/pull/23252
Author: iliaal

dispatch_param_event walks bound_params with ZEND_HASH_FOREACH while sqlite's EXEC_PRE hook can run __toString. From there execute() frees the table and bindValue() replaces buckets. This steals one _reserved bit as in_param_event (no layout size change; the header is installed) and throws Error from bind/execute/closeCursor while the hook is running. 8.5/master already have a refactored uint16_t bitfield with in_fetch; the forward merge needs in_param_event:1 and reserved:11.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.