StreamPollHandle UAF

Description

StreamPollHandle::__construct() caches the raw php_stream * pointer but only takes a reference on the stream's zend_resource container not on the stream itself. When the stream is closed with fclose() php_stream_free() calls pefree() on the php_stream and zend_resource_dtor() sets res->ptr = NULL yet the handle's cached data->stream field is never cleared and keeps pointing at the freed memory. The methods isValid() getFileDescriptor() and getStream() check the stale data->stream pointer (which is still non-NULL) instead of the resource so they dereference the freed php_stream. This is a use-after-free: getFileDescriptor() reaches php_stream_cast() which reads stream->ops and performs an indirect call through stream->ops->cast() from freed memory and getStream() even hands the freed stream back to userland as a live resource. The fix is to validate and read the stream through the held resource (data->res->ptr/type) rather than the cached raw pointer, or not cache data->stream at all.

PHP Version

8.6.0-dev. Component: Standard (ext/standard/io_poll.c)

Operating System

No response