com php-src: Fixed bug #68901 (use after free): NEWS ext/phar/phar_object.c

Commit: 920a0afbf8f83962c70aaf9a144810f320be92b3 Author: Xinchen Hui <laruence@php.net> Thu, 29 Jan 2015 00:00:09 +0800 Committer: Stanislav Malyshev <stas@php.net> Sat, 11 Apr 2015 16:28:07 -0700 Parents: 9a404df382d041127eaa601b3113587df45d510d Branches: PHP-5.4 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=920a0afbf8f83962c70aaf9a144810f320be92b3 Log: Fixed bug #68901 (use after free) Bugs: https://bugs.php.net/68901 Changed paths: M NEWS M ext/phar/phar_object.c Diff: diff --git a/NEWS b/NEWS index 0a83818..584defd 100644 --- a/NEWS +++ b/NEWS @@ -15,6 +15,9 @@ PHP NEWS - Sqlite3: . Fixed bug #66550 (SQLite prepared statement use-after-free). (Sean Heelan) +- Phar: + . Fixed bug #68901 (use after free). (bugreports at internot dot info) + - Postgres: . Fixed bug #68741 (Null pointer deference) (CVE-2015-1352). (Xinchen Hui) diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c index a021200..add1fa0 100644 --- a/ext/phar/phar_object.c +++ b/ext/phar/phar_object.c @@ -2211,8 +2211,8 @@ static zval *phar_rename_archive(phar_archive_data *phar, char *ext, zend_bool c } its_ok: if (SUCCESS == php_stream_stat_path(newpath, &ssb)) { - efree(oldpath); zend_throw_exception_ex(spl_ce_BadMethodCallException, 0 TSRMLS_CC, "phar \"%s\" exists and must be unlinked prior to conversion", newpath); + efree(oldpath); return NULL; } if (!phar->is_data) {