diff options
| -rw-r--r-- | Zend/tests/bug72162.phpt | 11 | ||||
| -rw-r--r-- | Zend/zend_builtin_functions.c | 5 |
2 files changed, 14 insertions, 2 deletions
diff --git a/Zend/tests/bug72162.phpt b/Zend/tests/bug72162.phpt new file mode 100644 index 0000000000..3cd12dea21 --- /dev/null +++ b/Zend/tests/bug72162.phpt @@ -0,0 +1,11 @@ +--TEST-- +Bug #72162 (use-after-free - error_reporting) +--FILE-- +<?php +error_reporting(1); +$var11 = new StdClass(); +$var16 = error_reporting($var11); +?> +okey +--EXPECT-- +okey diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c index e5f77d8960..6e251f6109 100644 --- a/Zend/zend_builtin_functions.c +++ b/Zend/zend_builtin_functions.c @@ -770,7 +770,8 @@ ZEND_FUNCTION(error_reporting) #endif old_error_reporting = EG(error_reporting); - if(ZEND_NUM_ARGS() != 0) { + if (ZEND_NUM_ARGS() != 0) { + zend_string *new_val = zval_get_string(err); do { zend_ini_entry *p = EG(error_reporting_ini_entry); @@ -796,7 +797,7 @@ ZEND_FUNCTION(error_reporting) zend_string_release(p->value); } - p->value = zval_get_string(err); + p->value = new_val; if (Z_TYPE_P(err) == IS_LONG) { EG(error_reporting) = Z_LVAL_P(err); } else { |