Skip to content

ext/ffi: Double free of anonymous types shared by a declarator list - #24646

Open
devnexen wants to merge 2 commits into
php:PHP-8.4from
devnexen:ffi_decl_list_ownership
Open

devnexen wants to merge 2 commits into
php:PHP-8.4from
devnexen:ffi_decl_list_ownership

Conversation

@devnexen

Copy link
Copy Markdown
Member

No description provided.

Each declarator copied the specifiers along with the anonymous struct, union or enum type they owned, so every symbol or field freed it. Declarators now borrow the type and the first one kept takes ownership; if none is kept, it is freed with the specifiers. Field lists regressed in 52c91f0.
zend_ffi_declare() and zend_ffi_add_enum_val() bailed out on a redeclaration without releasing the type they held. Free it before reporting the error.
@devnexen devnexen changed the title Ffi decl list ownership ext/ffi: Double free of anonymous types shared by a declarator list Oct 24, 2026
@devnexen
devnexen marked this pull request as ready for review October 24, 2026 14:32
@devnexen
devnexen requested a review from dstogov as a code owner October 24, 2026 14:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant