Fix GH-23332: HashTable iterator counter loses its saturation - #243
Closed
iliaal wants to merge 1 commit into
Closed
Fix GH-23332: HashTable iterator counter loses its saturation#243iliaal wants to merge 1 commit into
iliaal wants to merge 1 commit into
Conversation
nIteratorsCount saturates at 0xff and must stay frozen once it does, because HT_HAS_ITERATORS() is what makes zend_array_destroy() poison stale iterators before the table is freed. zend_hash_iterator_pos_ex() decremented the old table's counter while gating that decrement on the new table's overflow state, so a saturated counter could drop back below 0xff, later reach zero with iterators still pointing at the table, and leave it freed unpoisoned. The seven other arithmetic sites already gate on the table they mutate, and the wholesale transfers in array_splice() and array_unshift() move the counter intact. Fixes phpGH-23332
iliaal
force-pushed
the
fix/gh-23332-iterator-count-overflow
branch
from
August 21, 2026 13:57
5df5008 to
16de297
Compare
Owner
Author
|
Promoted upstream: php#23401 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
zend_hash_iterator_pos_ex() decrements iter->ht's iterator counter while gating that decrement on ht's overflow state. A saturated counter can therefore drop below 0xff and later reach zero with iterators still live, so the table gets freed without poisoning them. Wrong since ebf900a. SPL isn't required to trigger it, so the test uses generators and lives in Zend/tests. It is red only on a debug build; on a release build valgrind shows the invalid read and write.
Fixes php#23332