From be994280a7c2c3f13c661a25abdc432ccedc7550 Mon Sep 17 00:00:00 2001 From: Jeremy Schoemaker Date: Tue, 25 Aug 2026 12:57:56 -0500 Subject: [PATCH] fix: move error finalization after stream fields in stream_get_meta_data to prevent UAF Fix verified RED->GREEN. stream_get_meta_data UAF at ext/standard/streamsfuncs.c:566 - php_stream_error_operation_end_for_stream calls error_handler which can fclose() stream, then reads wrapperdata/wops/label/mode/orig_path from freed memory => ASan heap-use-after-free --- ext/standard/streamsfuncs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ext/standard/streamsfuncs.c b/ext/standard/streamsfuncs.c index d544e8bf5f0f..a03aed1ccdd4 100644 --- a/ext/standard/streamsfuncs.c +++ b/ext/standard/streamsfuncs.c @@ -563,7 +563,6 @@ PHP_FUNCTION(stream_get_meta_data) add_assoc_bool(return_value, "blocked", 1); add_assoc_bool(return_value, "eof", php_stream_eof(stream)); } - php_stream_error_operation_end_for_stream(stream); if (!Z_ISUNDEF(stream->wrapperdata)) { Z_ADDREF_P(&stream->wrapperdata); @@ -598,6 +597,7 @@ PHP_FUNCTION(stream_get_meta_data) add_assoc_string(return_value, "uri", stream->orig_path); } + php_stream_error_operation_end_for_stream(stream); } /* }}} */