Fix invalid read in mb_ord()

diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index 7bb4304aff7d95accd02c5b953e7feabb5e363a6..40938d88e84334dbcf58c41fc269c28f0d7de6e6 100644 (file)
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -4838,14 +4838,15 @@ static inline zend_long php_mb_ord(const char* str, size_t str_len, const char*
 
                mbfl_convert_filter_feed_string(filter, (const unsigned char *) str, str_len);
                mbfl_convert_filter_flush(filter);
-               mbfl_convert_filter_delete(filter);
 
                if (dev.pos < 1 || filter->num_illegalchar || dev.buffer[0] >= MBFL_WCSGROUP_UCS4MAX) {
+                       mbfl_convert_filter_delete(filter);
                        mbfl_wchar_device_clear(&dev);
                        return -1;
                }
 
                cp = dev.buffer[0];
+               mbfl_convert_filter_delete(filter);
                mbfl_wchar_device_clear(&dev);
                return cp;
        }