Skip to content

Fix GH-24707: Use-after-free in opendir() when user wrapper unregisters itself - #24711

Open
lazerg wants to merge 1 commit into
php:PHP-8.6from
lazerg:fix/gh-24707-opendir-unregister
Open

lazerg wants to merge 1 commit into
php:PHP-8.6from
lazerg:fix/gh-24707-opendir-unregister

Conversation

@lazerg

@lazerg lazerg commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

When a user wrapper's dir_opendir() unregisters the wrapper, the opener drops the last reference and frees it, then _php_stream_opendir() reads wrapper->wops->label to report the error. This copies the wrapper name before calling the opener, the same way _php_stream_open_wrapper_ex() already does for fopen().

Fixes #24707

@lazerg

lazerg commented Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

The MACOS_ARM64_DEBUG_NTS build failure also happens on PHP-8.6 itself, so it isn't caused by this change.

@iliaal iliaal left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified on PHP-8.6: opendir() and scandir() with a wrapper that unregisters itself are valgrind-clean with this, and it matches what _php_stream_open_wrapper_ex() already does.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants