Skip to content

Fix GH-24707: Use-after-free in opendir() when user wrapper unregisters itself - #24711

Open
lazerg wants to merge 1 commit into
php:PHP-8.6from
lazerg:fix/gh-24707-opendir-unregister
Open

lazerg wants to merge 1 commit into
php:PHP-8.6from
lazerg:fix/gh-24707-opendir-unregister

Conversation

@lazerg

@lazerg lazerg commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

When a user wrapper's dir_opendir() unregisters the wrapper, the opener drops the last reference and frees it, then _php_stream_opendir() reads wrapper->wops->label to report the error. This copies the wrapper name before calling the opener, the same way _php_stream_open_wrapper_ex() already does for fopen().

Fixes #24707

@lazerg

lazerg commented Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

The MACOS_ARM64_DEBUG_NTS build failure also happens on PHP-8.6 itself, so it isn't caused by this change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant