Internet Bug Bounty · Report #155223
Use After Free Vulnerability in array_walk()/array_walk_recursive()
Validstatus
5upvotes
13 Oct 2019disclosed
How it was found
https://bugs.php.net/bug.php?id=70713
I think this bugs is still security issue since this bug can be still triggered remotely in some real world&apps.
array_walk($parts, function ($value, $key) use (&$parts) {
if ($value === '..') {
unset($parts[$key], $parts[$key-1]);
$parts = array_values($parts); <== ['x', 'y', '..'] will be changed into ['x'] from the memory, it is possible to lead to use-after-free.
}
});