Skip to content

Fix GH-18018: RC1 data returned from offsetGet causes UAF in ArrayObject #18034

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from

Conversation

nielsdos
Copy link
Member

We should first check truthiness and only after that destroy the value.

@nielsdos nielsdos requested a review from Girgias as a code owner March 12, 2025 18:38
@nielsdos nielsdos linked an issue Mar 12, 2025 that may be closed by this pull request
…Object

We should first check truthiness and only after that destroy the value.
Copy link
Member

@Girgias Girgias left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a bit of an embarrassing bug. Thanks for finding and fixing it :)

@nielsdos nielsdos closed this in 27affd8 Mar 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

RC1 data returned from offsetGet causes UAF in ArrayObject
2 participants