Bug #70161 [Asn]: Double free or Use-After Free in PDO::sqliteCreateAggregate

Edit report at https://bugs.php.net/bug.php?id=70161&edit=1 ID: 70161 Updated by: ab@php.net Reported by: aebrahim722 at yahoo dot com Summary: Double free or Use-After Free in PDO::sqliteCreateAggregate Status: Assigned Type: Bug Package: PDO SQLite Operating System: Linux Ubuntu PHP Version: 7.0.0beta2 Assigned To: iliaa Block user comment: N Private report: N New Comment: @aebrahim722 Yeah, that was my point to ask for the reproduces. Actually it should be seen this way https://github.com/php/php-src/blob/4a2e40bb861bc3cf5fb6863e57486ed60316e97c/ext/pdo_sqlite/sqlite_driver.c#L605-L616 So it would be nice to have a repro code, otherwise looks like no issue here. Regards Anatol Previous Comments: ------------------------------------------------------------------------ [2015-07-28 21:01:33] aebrahim722 at yahoo dot com Hi, Can you please explain how double free is not possible? Kind regards. ------------------------------------------------------------------------ [2015-07-28 20:53:28] stas@php.net From the code, I see no possibility of double free there, but zend_str_release may possibly be called on null if zend_is_callable() does not initialize called_name. I could not find a codepath that does not initialize (bad object in zend_is_callable_ex does it but zend_is_callable does not pass an object to zend_is_callable_ex) but it may happen, now or on the future, so adding null check may be a good idea. ------------------------------------------------------------------------ [2015-07-28 20:00:46] ab@php.net Do you have a reproducer please? Thanks. ------------------------------------------------------------------------ [2015-07-28 19:41:18] aebrahim722 at yahoo dot com Description: ------------ Hi, 'cbname' is being freed from memory twice in PDO::sqliteCreateAggregate. Proof of concept: https://github.com/php/php-src/blob/4a2e40bb861bc3cf5fb6863e57486ed60316e97c/ext/pdo_sqlite/sqlite_driver.c#L610-L616 Expected result: ---------------- Freed only one time. Actual result: -------------- Freed twice => possible memory corruption. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=70161&edit=1