Edit report at https://bugs.php.net/bug.php?id=68902&edit=1
ID: 68902
Comment by: a at b dot c dot de
Reported by: bugreports at internot dot info
Summary: Use after free in ext/opcache/zend_persist.c
Status: Not a bug
Type: Bug
Package: opcache
Operating System: Linux Ubuntu 14.04
PHP Version: 5.5.21
Block user comment: N
Private report: N
New Comment:
And then see the line immediately after that....
op_array->literals = p;
Previous Comments:
------------------------------------------------------------------------
[2015-01-25 23:28:33] bugreports at internot dot info
232 orig_literals = op_array->literals;
?
------------------------------------------------------------------------
[2015-01-24 23:49:52] stas@php.net
I do not see dereferencing this pointer in any of these places.
------------------------------------------------------------------------
[2015-01-24 18:58:50] bugreports at internot dot info
Description:
------------
Hi,
In /ext/opcache/zend_persist.c:
239 efree(orig_literals);
but then it is used in multiple places:
255 opline->op1.zv = (zval*)((char*)opline->op1.zv +
((char*)op_array->literals - (char*)orig_literals));
.
263 opline->op2.zv = (zval*)((char*)opline->op2.zv +
((char*)op_array->literals - (char*)orig_literals));
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=68902&edit=1