Edit report at https://bugs.php.net/bug.php?id=68665&edit=1
ID: 68665
Updated by: ab@php.net
Reported by: honey at internot dot info
Summary: Invalid free
Status: Closed
Type: Bug
Package: *General Issues
Operating System: Linux Ubuntu 14.04
PHP Version: master-Git-2014-12-28 (Git)
Assigned To: ab
Block user comment: N
Private report: N
New Comment:
@honey, ok, this is fixed. Was reproducable only with big5 in mbstring. Thanks.
Previous Comments:
------------------------------------------------------------------------
[2014-12-28 13:21:43] ab@php.net
@honey, the first one is a good catch, affects also 5.6. But with the second one - can you provide a
test case for that?
Thanks
------------------------------------------------------------------------
[2014-12-28 13:03:07] ab@php.net
Automatic comment on behalf of ab
Revision: http://git.php.net/?p=php-src.git;a=commit;h=a72cd07f2983dc43a6bb35209dc4687852e53c09
Log: Fixed bug #68665 (Invalid free)
------------------------------------------------------------------------
[2014-12-28 04:01:32] honey at internot dot info
And in /Zend/zend_language_scanner.l:
1934 s = Z_STRVAL_P(zendlval);
[..]
1938 efree(s);
------------------------------------------------------------------------
[2014-12-28 03:54:23] honey at internot dot info
Description:
------------
Hi,
In /ext/fileinfo/libmagic/apprentice.c, an invalid free occurs:
1173 char mfn[MAXPATHLEN];
[..]
1198 efree(mfn);
as an array is not heap allocated, it cannot be freed.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=68665&edit=1