Bug #78943 [NEW]: mail() may release string with refcount==1 twice

From: cmb Operating system: * PHP version: 7.2.26RC1 Package: *Mail Related Bug Type: Bug Bug description:mail() may release string with refcount==1 twice Description: ------------ When a lower cased string[1] is passed as $additional_headers argument to mail(), it may be zend_string_released() twice[2]. I have noticed this when looking at PR #4995[3], where bug72463_2.phpt often results in a segfault; I couldn't reproduce the segfault with other versions, but still this double release looks very wrong. [1] <https://github.com/php/php-src/blob/php-7.3.12/win32/sendmail.c#L210-L213> [2] <https://github.com/php/php-src/blob/php-7.3.12/win32/sendmail.c#L270-L273> [3] <https://github.com/php/php-src/pull/4995> Test script: --------------- <?php mail('cmbecker69@gmx.de', 'test', 'test message', 'from: cmbecker69@gmx.de'); -- Edit bug report at https://bugs.php.net/bug.php?id=78943&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=78943&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=78943&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=78943&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=78943&r=needscript Try newer version: https://bugs.php.net/fix.php?id=78943&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=78943&r=support Expected behavior: https://bugs.php.net/fix.php?id=78943&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=78943&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=78943&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=78943&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=78943&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=78943&r=dst IIS Stability: https://bugs.php.net/fix.php?id=78943&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=78943&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=78943&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=78943&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=78943&r=mysqlcfg