Skip to content

Zend: Fix string leak in zend_update_property_string{,l} on write failure#22039

Open
iliaal wants to merge 1 commit into
php:masterfrom
iliaal:fix/zend-update-property-stringl-readonly-leak
Open

Zend: Fix string leak in zend_update_property_string{,l} on write failure#22039
iliaal wants to merge 1 commit into
php:masterfrom
iliaal:fix/zend-update-property-stringl-readonly-leak

Conversation

@iliaal
Copy link
Copy Markdown
Contributor

@iliaal iliaal commented May 13, 2026

The four zend_update_{,static_}property_string{,l}() helpers set the local tmp zval refcount to 0 so the consume path can absorb the only reference. Every write-rejection path returns before that consume happens (readonly property, asymmetric visibility, type mismatch, missing static property, magic __set throw, type-check rejection on a typed static), and the local zend_string leaks at refcount 0. Reproduces as a 64-byte orphan under --enable-debug or ASan. Fix builds the zval at refcount 1 and zval_ptr_dtors it after the write; the consumer's Z_TRY_ADDREF_P and the local dtor balance, slot end state matches the pre-patch value.

The memory leak here is demonstrated via test associated with PR #22040

…lure

The four zend_update_{,static_}property_string{,l} helpers built a
zval with refcount 0 and called the write path, expecting the
consumer to absorb the only reference. Failure paths (readonly,
asymmetric visibility, type mismatch, magic __set throw) returned
without consuming the value, leaking the zend_string at refcount 0.
Build the zval normally and zval_ptr_dtor it after the write.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant