Bug #76409 [Csd]: heap use after free in _php_stream_free

From: Date: Tue, 26 Jun 2018 02:52:32 +0000
Subject: Bug #76409 [Csd]: heap use after free in _php_stream_free
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-215973@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=76409&edit=1

 ID:                 76409
 User updated by:    geeknik at protonmail dot ch
 Reported by:        geeknik at protonmail dot ch
 Summary:            heap use after free in _php_stream_free
 Status:             Closed
 Type:               Bug
 Package:            EXIF related
 Operating System:   Ubuntu 16 LTS
 PHP Version:        7.2Git-2018-06-02 (Git)
 Assigned To:        cmb
 Block user comment: N
 Private report:     N

 New Comment:

CVE-2018-12882 has been assigned to this bug.


Previous Comments:
------------------------------------------------------------------------
[2018-06-09 16:55:36] cmb@php.net

Indeed, PHP-7.2 as well as master have been affected (but not
earlier version branches), and both have been fixed.

------------------------------------------------------------------------
[2018-06-09 16:39:34] geeknik at protonmail dot ch

FYI, this affects the 7.2.6 release as well, but I haven't tested other versions.

------------------------------------------------------------------------
[2018-06-09 16:22:00] cmb@php.net

Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=3fdde65617e9f954e2c964768aac8831005497e5
Log: Fix #76409: heap use after free in _php_stream_free

------------------------------------------------------------------------
[2018-06-03 12:08:56] cmb@php.net

The following patch has been added/updated:

Patch Name: avoid-double-free.patch
Revision:   1528027735
URL:        https://bugs.php.net/patch-display.php?bug=76409&patch=avoid-double-free.patch&revision=1528027735

------------------------------------------------------------------------
[2018-06-03 12:08:24] cmb@php.net

Thanks for reporting this issue.

It seems to me the avoid-double-free.patch fixes the bug.

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=76409


--
Edit this bug report at https://bugs.php.net/bug.php?id=76409&edit=1

Thread (8 messages)

« previous php.bugs (#215973) next »