mirror of
https://github.com/php/php-src.git
synced 2024-09-21 09:57:23 +00:00
eb8c3cb79a
The create_obj handler of InternalIterator is overwritten, but not the
clone_obj handler. This is not allowed.
In PHP 8.2 this didn't cause a segfault because the standard object
handler was used for the clone instead of the internal handler.
So then it allocates and frees the object using the standard object handlers.
In 8.3 however, the object is created using the standard object handler and
freed using the custom handler, resulting in the buffer overflow.
Even though bisect points to
|
||
|---|---|---|
| .. | ||
| tests | ||
| config.m4 | ||
| config.w32 | ||
| fiber_arginfo.h | ||
| fiber.c | ||
| fiber.h | ||
| fiber.stub.php | ||
| iterators_arginfo.h | ||
| iterators.c | ||
| iterators.h | ||
| iterators.stub.php | ||
| observer.c | ||
| observer.h | ||
| php_test.h | ||
| test_arginfo.h | ||
| test.c | ||
| test.h | ||
| test.stub.php | ||