[GIT-PULLS] [php-src] PR #23388: ext/spl: SplDoublyLinkedList::serialize() use-after-free on element r…
[email protected] (devnexen)
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/23388 Author: devnexen …emoval. Fix #23385 The serialization loop passed php_var_serialize() a pointer into the list element itself, so a userland __serialize() unsetting that entry freed both the element and its payload while the serializer was still walking them. Serialize a copy of the element data instead, which outlives the callback.