Fix use-after-free of object through __isset() and globals

Fixes GH-18845

Author: iluuu1994

Zend/tests/gh18845.phpt

@@ -0,0 +1,27 @@
+--TEST--
+GH-18845: Use-after-free of object through __isset() and globals
+--FILE--
+<?php
+
+#[AllowDynamicProperties]
+class C {
+    public $dummy;
+    public function __isset($x) {
+        $GLOBALS['c'] = null;
+        return true;
+    }
+}
+
+$c = new C;
+var_dump($c->prop ?? 1);
+
+$r = new ReflectionClass(C::class);
+$c = $r->newLazyProxy(function () {
+    throw new Exception('Not reached');
+});
+var_dump($c->prop ?? 1);
+
+?>
+--EXPECT--
+int(1)
+int(1)

Zend/zend_object_handlers.c

@@ -905,7 +905,13 @@ ZEND_API zval *zend_std_read_property(zend_object *zobj, zend_string *name, int
 			if (zobj->ce->__get && !((*guard) & IN_GET)) {
 				goto call_getter;
 			}
+
+			bool obj_is_freed = GC_REFCOUNT(zobj) == 1;
 			OBJ_RELEASE(zobj);
+			if (UNEXPECTED(obj_is_freed)) {
+				retval = &EG(uninitialized_zval);
+				goto exit;
+			}
 		} else if (zobj->ce->__get && !((*guard) & IN_GET)) {
 			goto call_getter_addref;
 		}