summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBob Weinand <bobwei9@hotmail.com>2015-12-06 02:54:28 +0100
committerBob Weinand <bobwei9@hotmail.com>2015-12-06 02:54:28 +0100
commitaa8cac578e22e65ceda63d3518d696ccfc920494 (patch)
tree7dcda989fff65b311e63ad21275aa98ddb9353ee
parent559ede17e109adec5dadff3290090e7141ad40ae (diff)
downloadphp-git-aa8cac578e22e65ceda63d3518d696ccfc920494.tar.gz
Fix double free in formatted_print.c
-rw-r--r--NEWS1
-rw-r--r--ext/standard/formatted_print.c6
2 files changed, 1 insertions, 6 deletions
diff --git a/NEWS b/NEWS
index 788aa0fd1a..266b227d6e 100644
--- a/NEWS
+++ b/NEWS
@@ -27,6 +27,7 @@ PHP NEWS
. Fixed bug #70987 (static::class within Closure::call() causes segfault).
(Andrea)
. Fixed bug #71013 (Incorrect exception handler with yield from). (Bob)
+ . Fixed double free in error condition of format printer. (Bob)
- CLI server:
. Fixed bug #71005 (Segfault in php_cli_server_dispatch_router()). (Adam)
diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c
index 081dfc4a07..e206bb9225 100644
--- a/ext/standard/formatted_print.c
+++ b/ext/standard/formatted_print.c
@@ -518,9 +518,6 @@ php_formatted_print(zend_execute_data *execute_data, int use_array, int format_o
efree(newargs);
}
php_error_docref(NULL, E_WARNING, "Width must be greater than zero and less than %d", INT_MAX);
- if (newargs) {
- efree(newargs);
- }
return NULL;
}
adjusting |= ADJ_WIDTH;
@@ -540,9 +537,6 @@ php_formatted_print(zend_execute_data *execute_data, int use_array, int format_o
efree(newargs);
}
php_error_docref(NULL, E_WARNING, "Precision must be greater than zero and less than %d", INT_MAX);
- if (newargs) {
- efree(newargs);
- }
return NULL;
}
adjusting |= ADJ_PRECISION;