Fix GH-23204: use-after-free when __toString() destroys an array argument - #23207

Closed

lazerg wants to merge 4 commits into

php:PHP-8.4from

lazerg:fix/gh-23204-implode-uaf

Commits on Aug 10, 2026

Fix GH-23204: use-after-free in implode() when __toString() destroys the array
lazerg
committed
6c2ad99
Fix the same use-after-free in strtr() and str_replace()
lazerg
committed
127f016

Commits on Aug 11, 2026

Credit the reporter in the GH-23204 test
lazerg
committed
b9443b8
Credit e1abrador and assert the exception class in the GH-23204 test
lazerg
committed
36daac5