Bug #68665 [Csd]: Invalid free

Edit report at https://bugs.php.net/bug.php?id=68665&edit=1 ID: 68665 User updated by: honey at internot dot info Reported by: honey at internot dot info Summary: Invalid free Status: Closed Type: Bug Package: *General Issues Operating System: Linux Ubuntu 14.04 PHP Version: master-Git-2014-12-28 (Git) Assigned To: ab Block user comment: N Private report: N New Comment: Did you make a test-case? If so, could you paste it here? Thanks Previous Comments: ------------------------------------------------------------------------ [2014-12-28 15:39:06] ab@php.net @honey, ok, this is fixed. Was reproducable only with big5 in mbstring. Thanks. ------------------------------------------------------------------------ [2014-12-28 13:21:43] ab@php.net @honey, the first one is a good catch, affects also 5.6. But with the second one - can you provide a test case for that? Thanks ------------------------------------------------------------------------ [2014-12-28 13:03:07] ab@php.net Automatic comment on behalf of ab Revision: http://git.php.net/?p=php-src.git;a=commit;h=a72cd07f2983dc43a6bb35209dc4687852e53c09 Log: Fixed bug #68665 (Invalid free) ------------------------------------------------------------------------ [2014-12-28 04:01:32] honey at internot dot info And in /Zend/zend_language_scanner.l: 1934 s = Z_STRVAL_P(zendlval); [..] 1938 efree(s); ------------------------------------------------------------------------ [2014-12-28 03:54:23] honey at internot dot info Description: ------------ Hi, In /ext/fileinfo/libmagic/apprentice.c, an invalid free occurs: 1173 char mfn[MAXPATHLEN]; [..] 1198 efree(mfn); as an array is not heap allocated, it cannot be freed. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68665&edit=1