Only for the curious...
- Overview Two cached bucket pointers, one freed tree.
- A heap use-after-free in PHP session.upload_progress reaching zend_call_function.
- PHP's session.upload_progress handler (php_session_rfc1867_callback in ext/session/session.c) caches two raw zval * bucket pointers into live HashTables: post_bytes_processed and current_file_bytes_processed.
Unverified
- Overview Two cached bucket pointers, one freed tree.
- A heap use-after-free in PHP session.upload_progress reaching zend_call_function.
- PHP's session.upload_progress handler (php_session_rfc1867_callback in ext/session/session.c) caches two raw zval * bucket pointers into live HashTables: post_bytes_processed and current_file_bytes_processed.
Sources: Jackalsyn