From eb8c3cb79a9e3c44a367b8ccb5fcf1207338ab8b Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Tue, 9 Jul 2024 00:14:28 +0200
Subject: [PATCH] Fix GH-14741: Segmentation fault in Zend/zend_types.h

The create_obj handler of InternalIterator is overwritten, but not the
clone_obj handler. This is not allowed.
In PHP 8.2 this didn't cause a segfault because the standard object
handler was used for the clone instead of the internal handler.
So then it allocates and frees the object using the standard object handlers.
In 8.3 however, the object is created using the standard object handler and
freed using the custom handler, resulting in the buffer overflow.
Even though bisect points to 1e1ea4f this only reveals the bug.

Closes GH-14882.
---
 NEWS                             |  1 +
 Zend/zend_interfaces.c           |  1 +
 ext/zend_test/tests/gh14741.phpt | 17 +++++++++++++++++
 3 files changed, 19 insertions(+)
 create mode 100644 ext/zend_test/tests/gh14741.phpt

diff --git a/NEWS b/NEWS
index 411c5de823e17..db78d1404db09 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,7 @@ PHP                                                                        NEWS
   . Fixed bug GH-14590 (Memory leak in FPM test gh13563-conf-bool-env.phpt.
     (nielsdos)
   . Fixed OSS-Fuzz #69765. (nielsdos)
+  . Fixed bug GH-14741 (Segmentation fault in Zend/zend_types.h). (nielsdos)
 
 - Dom:
   . Fixed bug GH-14702 (DOMDocument::xinclude() crash). (nielsdos)
diff --git a/Zend/zend_interfaces.c b/Zend/zend_interfaces.c
index 42fbccd4a746f..b8cc5e94caca8 100644
--- a/Zend/zend_interfaces.c
+++ b/Zend/zend_interfaces.c
@@ -666,6 +666,7 @@ ZEND_API void zend_register_interfaces(void)
 
 	memcpy(&zend_internal_iterator_handlers, zend_get_std_object_handlers(),
 		sizeof(zend_object_handlers));
+	zend_internal_iterator_handlers.clone_obj = NULL;
 	zend_internal_iterator_handlers.free_obj = zend_internal_iterator_free;
 }
 /* }}} */
diff --git a/ext/zend_test/tests/gh14741.phpt b/ext/zend_test/tests/gh14741.phpt
new file mode 100644
index 0000000000000..389692f3de2bd
--- /dev/null
+++ b/ext/zend_test/tests/gh14741.phpt
@@ -0,0 +1,17 @@
+--TEST--
+GH-14741 (Segmentation fault in Zend/zend_types.h)
+--EXTENSIONS--
+zend_test
+--FILE--
+<?php
+$subject = new \ZendTest\Iterators\TraversableTest();
+$it = $subject->getIterator();
+try {
+    clone $it;
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+Trying to clone an uncloneable object of class InternalIterator
+TraversableTest::drop