diff options
| author | Xinchen Hui <laruence@php.net> | 2015-01-29 00:00:09 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@php.net> | 2015-01-29 00:00:09 +0800 |
| commit | b2cf3f064b8f5efef89bb084521b61318c71781b (patch) | |
| tree | 1eadf3d9d45315a46b673046a7dccc6113742cb2 | |
| parent | 4c5995b1729b100b00707ddf32d072355dcc3ae8 (diff) | |
| download | php-git-b2cf3f064b8f5efef89bb084521b61318c71781b.tar.gz | |
Fixed bug #68901 (use after free)
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/phar/phar_object.c | 2 |
2 files changed, 4 insertions, 1 deletions
@@ -26,6 +26,9 @@ PHP NEWS . Fixed bug #68750 (PDOMysql with mysqlnd does not allow the usage of named pipes). (steffenb198@aol.com) +- Phar: + . Fixed bug #68901 (use after free). (bugreports at internot dot info) + - Sqlite3: . Fixed bug #68260 (SQLite3Result::fetchArray declares wrong required_num_args). (Julien) diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c index 3671054b81..712795b1a4 100644 --- a/ext/phar/phar_object.c +++ b/ext/phar/phar_object.c @@ -2139,8 +2139,8 @@ static zval *phar_rename_archive(phar_archive_data *phar, char *ext, zend_bool c } its_ok: if (SUCCESS == php_stream_stat_path(newpath, &ssb)) { - efree(oldpath); zend_throw_exception_ex(spl_ce_BadMethodCallException, 0 TSRMLS_CC, "phar \"%s\" exists and must be unlinked prior to conversion", newpath); + efree(oldpath); return NULL; } if (!phar->is_data) { |