diff options
| author | Xinchen Hui <laruence@gmail.com> | 2016-06-13 18:20:26 -0700 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2016-06-13 18:20:26 -0700 |
| commit | 3d5641872239cbd4ec8855b05c90f94fb0d11d7e (patch) | |
| tree | 8f5d813a2a1c0db87d0cbdd6669a2a304a3029aa /ext/mbstring/php_mbregex.c | |
| parent | d1ab974f0bfb202d9a49a6cc152293b4d013ef46 (diff) | |
| download | php-git-3d5641872239cbd4ec8855b05c90f94fb0d11d7e.tar.gz | |
Fixed bug #72399 (Use-After-Free in MBString (search_re))
Diffstat (limited to 'ext/mbstring/php_mbregex.c')
| -rw-r--r-- | ext/mbstring/php_mbregex.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c index 73c94da5e9..c1f9fc2560 100644 --- a/ext/mbstring/php_mbregex.c +++ b/ext/mbstring/php_mbregex.c @@ -459,8 +459,12 @@ static php_mb_regex_t *php_mbregex_compile_pattern(const char *pattern, int patl retval = NULL; goto out; } + if (rc == MBREX(search_re)) { + /* reuse the new rc? see bug #72399 */ + MBREX(search_re) = NULL; + } zend_hash_str_update_ptr(&MBREX(ht_rc), (char *)pattern, patlen, retval); - } else if (rc) { + } else { retval = rc; } out: |