fix double-free in zai_hook_gshutdown

cataphract · cataphract · commit 527a671b7993 · 2026-05-19T02:32:10.000+01:00
Doesn't fix the fact this is called repeatedly in the main thread.
When called by `ts_free_id` the threads whose data we want to free are
gone. For this to work propoerly we would need to register an actual
thread data destructor.
diff --git a/zend_abstract_interface/hook/hook.c b/zend_abstract_interface/hook/hook.c
@@ -1266,7 +1266,10 @@ void zai_hook_rshutdown(void) {
     }
 }
 
-void zai_hook_gshutdown(void) { free(zai_hook_tls); }
+void zai_hook_gshutdown(void) {
+    free(zai_hook_tls);
+    zai_hook_tls = NULL;
+}
 
 void zai_hook_mshutdown(void) {
     zend_hash_destroy(&zai_hook_static);

Original file line number	Diff line number	Diff line change
`@@ -1266,7 +1266,10 @@ void zai_hook_rshutdown(void) {`
`1266`	`1266`	`}`
`1267`	`1267`	`}`
`1268`	`1268`
`1269`		`-void zai_hook_gshutdown(void) { free(zai_hook_tls); }`
	`1269`	`+void zai_hook_gshutdown(void) {`
	`1270`	`+ free(zai_hook_tls);`
	`1271`	`+ zai_hook_tls = NULL;`
	`1272`	`+}`
`1270`	`1273`
`1271`	`1274`	`void zai_hook_mshutdown(void) {`
`1272`	`1275`	`zend_hash_destroy(&zai_hook_static);`