Skip to content

Conversation

@pull
Copy link

@pull pull bot commented Jul 31, 2025

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.3)

Can you help keep this open source service alive? 💖 Please sponsor : )

arnaud-lb and others added 4 commits July 31, 2025 08:45
Normally we prevent generators from being resumed while they are already
running, but we failed to do so for generators delegating to non-Generators. As
a result such generator can be resumed, terminated, which causes unexpected
results (crashes) later.

In gh19306.phpt in particular, the generator delegate It::getIterator() suspends
while being called by generator g(). We then resume g(), which throws while
trying to resume It::getIterator(). This causes g() and It::getIterator()
to be released. We then UAF when resuming the Fiber in It::getIterator().

Fix this by ensuring that generators are marked as running while they fetch
the next value from the delegate.

Fixes GH-19306
Closes GH-19315
* PHP-8.3:
  Prevent resumption of generator suspended in yield from
* PHP-8.4:
  Prevent resumption of generator suspended in yield from
@pull pull bot locked and limited conversation to collaborators Jul 31, 2025
@pull pull bot added the ⤵️ pull label Jul 31, 2025
@pull pull bot merged commit bdffded into wudi:master Jul 31, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants