[GIT-PULLS] [php-src] PR #23458: fix: move error finalization after stream fields in stream_get_meta_data to prevent UAF
[email protected] (shoemoney)
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/23458 Author: shoemoney Fixes heap-use-after-free in stream_get_meta_data. php_stream_error_operation_end_for_stream invokes the error handler which may fclose the stream. In the previous order this ran before wrapperdata, wrapper type, stream type, mode and uri were copied into the return value, so those reads touched freed memory. Deferring finalization until after all stream fields are copied closes the UAF window. The change is a one-line reorder within PHP_FUNCTION(stream_get_meta_data). It keeps begin, populate and eof handling unchanged and only moves the end call after the last stream field access. This matches the pattern needed for the sibling reports 23259 and 23264 which share the same root cause. Written in conjunction with my pair programmer Claude.