Bug #68902 [Nab]: Use after free in ext/opcache/zend_persist.c

Edit report at https://bugs.php.net/bug.php?id=68902&edit=1 ID: 68902 User updated by: bugreports at internot dot info Reported by: bugreports at internot dot info Summary: Use after free in ext/opcache/zend_persist.c Status: Not a bug Type: Bug Package: opcache Operating System: Linux Ubuntu 14.04 PHP Version: 5.5.21 Block user comment: N Private report: N New Comment: 232 orig_literals = op_array->literals; ? Previous Comments: ------------------------------------------------------------------------ [2015-01-24 23:49:52] stas@php.net I do not see dereferencing this pointer in any of these places. ------------------------------------------------------------------------ [2015-01-24 18:58:50] bugreports at internot dot info Description: ------------ Hi, In /ext/opcache/zend_persist.c: 239 efree(orig_literals); but then it is used in multiple places: 255 opline->op1.zv = (zval*)((char*)opline->op1.zv + ((char*)op_array->literals - (char*)orig_literals)); . 263 opline->op2.zv = (zval*)((char*)opline->op2.zv + ((char*)op_array->literals - (char*)orig_literals)); ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68902&edit=1