Description
Originally reported by @P0cas, please credit in test.
The following code:
<?php
[$reader, $writer] = stream_socket_pair(STREAM_PF_UNIX, STREAM_SOCK_STREAM, 0);
$context = new Io\Poll\Context(Io\Poll\Backend::Epoll);
$handle = new StreamPollHandle($reader);
$first = $context->add($handle, [Io\Poll\Event::Read]);
$first->remove();
// Backend registration succeeds, but the Context hash insertion collides
// with $first and its failure is ignored.
$second = $context->add($handle, [Io\Poll\Event::Read]);
// Only $first is invalidated before php_poll_ctx is freed.
unset($context);
// $second still has active=true and the freed php_poll_ctx pointer.
$second->remove();
Resulted in this output:
==269199==ERROR: AddressSanitizer: heap-use-after-free on address 0x71b5415f3884 at pc 0x5aa806efc8b9 bp 0x7ffdaec76160 sp 0x7ffdaec76158
READ of size 1 at 0x71b5415f3884 thread T0
#0 0x5aa806efc8b8 in php_poll_remove /home/ilutov/Developer/php-src/main/poll/poll_core.c:282
#1 0x5aa806be9f56 in zim_Io_Poll_Watcher_remove /home/ilutov/Developer/php-src/ext/standard/io_poll.c:643
PHP Version
Operating System
No response
Description
Originally reported by @P0cas, please credit in test.
The following code:
Resulted in this output:
PHP Version
Operating System
No response