com php-src: Fix use after free in mb_send_mail: ext/mb string/mbstring.c
| From: | Nikita Popov | Date: | Sun, 23 Jul 2017 09:55:26 +0000 |
| Subject: | com php-src: Fix use after free in mb_send_mail: ext/mb string/mbstring.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-98740@lists.php.net to get a copy of this message | ||
Commit: 9af5b7f33d58c20a6770ae2d9e6cc9fc7f011374
Author: Nikita Popov <nikita.ppv@gmail.com> Sun, 23 Jul 2017 11:55:00 +0200
Parents: 47334646dbc0a6b62870a65bdc79bb61ff1529d5
Branches: PHP-7.2 master
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=9af5b7f33d58c20a6770ae2d9e6cc9fc7f011374
Log:
Fix use after free in mb_send_mail
Changed paths:
M ext/mbstring/mbstring.c
Diff:
diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index 3edaf87..5fcd17d 100644
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -4685,10 +4685,10 @@ PHP_FUNCTION(mb_send_mail)
p = ZSTR_VAL(str_headers);
n = ZSTR_LEN(str_headers);
mbfl_memory_device_strncat(&device, p, n);
- zend_string_release(str_headers);
if (n > 0 && p[n - 1] != '\n') {
mbfl_memory_device_strncat(&device, "\n", 1);
}
+ zend_string_release(str_headers);
}
if (!zend_hash_str_exists(&ht_headers, "MIME-VERSION",
sizeof("MIME-VERSION") - 1)) {