Use-after-free in SplDoublyLinkedList::serialize()

[iluuu1994]

Description

Originally reported by @f9j2n6nd8k-eng.

The following code:

<?php

class Evil {
    public function __serialize(): array {
        global $dll;
        unset($dll[0]); // frees the current element while var.c:991 iterates its array
        return [];
    }
}
$dll = new SplDoublyLinkedList();
$dll->push([new Evil(), "pad1", "pad2"]);
$dll->push("victim");
echo $dll->serialize(), "\n";

Resulted in this output:

==32873==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000039bc8 at pc 0x000100f88ab8 bp 0x00016f85c710 sp 0x00016f85c708
READ of size 4 at 0x606000039bc8 thread T0
    #0 0x000100f88ab4 in php_var_serialize_nested_data var.c:991
    #1 0x000100f7e854 in php_var_serialize_intern var.c:1307
    #2 0x000100f7cf50 in php_var_serialize var.c:1323
...
freed by thread T0 here:
    #0 0x0001047d9258 in free+0x7c (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x41258)
    #1 0x000100d93234 in zim_SplDoublyLinkedList_offsetUnset spl_dllist.c:796
    #2 0x000101324a24 in zend_call_function zend_execute_API.c
...
0x606000039bc8 is located 8 bytes inside of 56-byte region [0x606000039bc0,0x606000039bf8)

PHP Version

PHP 8.4+

Operating System

No response