Skip to content

Fix GH-24989: Use-after-free in GC when an exception is thrown. - #24993

Closed
devnexen wants to merge 1 commit into
php:PHP-8.4from
devnexen:gh24989
Closed

devnexen wants to merge 1 commit into
php:PHP-8.4from
devnexen:gh24989

Conversation

@devnexen

Copy link
Copy Markdown
Member

cleanup_live_vars() freed live temporaries without clearing their slots, so GC triggered by a destructor during unwinding read freed memory.

cleanup_live_vars() freed live temporaries without clearing their slots,
so GC triggered by a destructor during unwinding read freed memory.
@devnexen devnexen linked an issue Oct 28, 2026 that may be closed by this pull request
@devnexen
devnexen marked this pull request as ready for review October 28, 2026 05:23
@devnexen
devnexen requested a review from dstogov as a code owner October 28, 2026 05:23
@devnexen
devnexen requested a review from arnaud-lb October 28, 2026 05:23

@arnaud-lb arnaud-lb left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me!

@devnexen devnexen closed this in 7abaad3 Oct 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Use-after-free in GC when an exception is thrown

3 participants