Bug #80966 [NEW]: A potential use after free bug in ext/standard/browscap.c

From: lylgood at foxmail dot com Operating system: All PHP version: master-Git-2021-04-18 (Git) Package: *Extensibility Functions Bug Type: Bug Bug description:A potential use after free bug in ext/standard/browscap.c Description: ------------ File: ext/standard/browscap.c Bug Function: php_browscap_parser_cb In function php_browscap_parser_cb, pattern is re-assigned by pattern = zend_new_interned_string() at line 368. Then if ZSTR_IS_INTERNED(pattern) is false, pattern will be freed via zend_string_release(pattern) at line 372. But after that, pattern is still used at line 378 by zend_hash_update_ptr(bdata->htab, pattern, entry), which is a use after free bug. Test script: --------------- if (persistent) { 368: pattern = zend_new_interned_string(zend_string_copy(pattern)); if (ZSTR_IS_INTERNED(pattern)) { Z_TYPE_FLAGS_P(arg1) = 0; } else { 372: zend_string_release(pattern); //pattern could be freed ! } } ... 378: zend_hash_update_ptr(bdata->htab, pattern, entry);//freed pattern is used ! -- Edit bug report at https://bugs.php.net/bug.php?id=80966&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=80966&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=80966&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=80966&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=80966&r=needscript Try newer version: https://bugs.php.net/fix.php?id=80966&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=80966&r=support Expected behavior: https://bugs.php.net/fix.php?id=80966&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=80966&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=80966&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=80966&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=80966&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=80966&r=dst IIS Stability: https://bugs.php.net/fix.php?id=80966&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=80966&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=80966&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=80966&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=80966&r=mysqlcfg