Fix GH-23332: HashTable iterator counter loses its saturation - #23401
Open
iliaal wants to merge 1 commit into
Open
Fix GH-23332: HashTable iterator counter loses its saturation#23401iliaal wants to merge 1 commit into
iliaal wants to merge 1 commit into
Conversation
nIteratorsCount saturates at 0xff and must stay frozen once it does, because HT_HAS_ITERATORS() is what makes zend_array_destroy() poison stale iterators before the table is freed. zend_hash_iterator_pos_ex() decremented the old table's counter while gating that decrement on the new table's overflow state, so a saturated counter could drop back below 0xff, later reach zero with iterators still pointing at the table, and leave it freed unpoisoned. The seven other arithmetic sites already gate on the table they mutate, and the wholesale transfers in array_splice() and array_unshift() move the counter intact. Fixes phpGH-23332
iliaal
force-pushed
the
fix/gh-23332-iterator-count-overflow
branch
from
August 21, 2026 14:02
16de297 to
e3bd6c4
Compare
devnexen
approved these changes
Aug 21, 2026
devnexen
left a comment
devnexen
left a comment
Member
There was a problem hiding this comment.
the fix looks good I may suggest however to wait gina's review before merging
Member
|
I have never really dealt with the iterator code, and @iluuu1994 seems to be one of the people most recently touching this code so they might have a better opinion. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
zend_hash_iterator_pos_ex() decrements iter->ht's iterator counter while gating that decrement on ht's overflow state. A saturated counter can therefore drop below 0xff and later reach zero with iterators still live, so zend_array_destroy() frees the table without poisoning them. Wrong since ebf900a.
Generators reach the same code as ArrayObject, so the test uses them and lives in Zend/tests. It is red only on a debug build; on a release build valgrind reports the invalid read and write.
luizmenos found the same one-line change independently in #23399 and closed it in favor of this one; NEWS credits both of us.
Fixes GH-23332