Sec Bug->Bug #68902 [Opn->Nab]: Use after free in ext/opcache/zend_persist.c

Edit report at https://bugs.php.net/bug.php?id=68902&edit=1 ID: 68902 Updated by: stas@php.net Reported by: bugreports at internot dot info -Summary: Use after free +Summary: Use after free in ext/opcache/zend_persist.c -Status: Open +Status: Not a bug -Type: Security +Type: Bug Package: opcache Operating System: Linux Ubuntu 14.04 PHP Version: 5.5.21 Block user comment: N Private report: Y New Comment: I do not see dereferencing this pointer in any of these places. Previous Comments: ------------------------------------------------------------------------ [2015-01-24 18:58:50] bugreports at internot dot info Description: ------------ Hi, In /ext/opcache/zend_persist.c: 239 efree(orig_literals); but then it is used in multiple places: 255 opline->op1.zv = (zval*)((char*)opline->op1.zv + ((char*)op_array->literals - (char*)orig_literals)); . 263 opline->op2.zv = (zval*)((char*)opline->op2.zv + ((char*)op_array->literals - (char*)orig_literals)); ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68902&edit=1