Fix #76164: exif_read_data zend_mm_heap corrupted

We must not release parsed parameters ourselves, since this is already
done by the engine.

diff --git a/NEWS b/NEWS
index 9aa92bbaa170a63e2577fce9d65a26be87bf1ca7..c82db3257d2027e4286c7ef61be00b3d9d318339 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2018, PHP 7.2.6
 
+- EXIF:
+  . Fixed bug #76164 (exif_read_data zend_mm_heap corrupted). (cmb)
+
 - Session:
   . Fixed bug #74892 (Url Rewriting (trans_sid) not working on urls that start
     with "#"). (Andrew Nester)

diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index d9c591496bd7a31e6bef0cdd9d931f438fa6126a..43bd7a33c3dc1916158e42907f15008901898d8f 100644 (file)
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -4457,13 +4457,11 @@ PHP_FUNCTION(exif_read_data)
 #ifdef EXIF_DEBUG
                sections_str = exif_get_sectionlist(sections_needed);
                if (!sections_str) {
-                       zend_string_release(z_sections_needed);
                        RETURN_FALSE;
                }
                exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Sections needed: %s", sections_str[0] ? sections_str : "None");
                EFREE_IF(sections_str);
 #endif
-               zend_string_release(z_sections_needed);
        }
 
        if (Z_TYPE_P(stream) == IS_RESOURCE) {

diff --git a/ext/exif/tests/bug76164.phpt b/ext/exif/tests/bug76164.phpt
new file mode 100644 (file)
index 0000000..ea77e1d
--- /dev/null
+++ b/ext/exif/tests/bug76164.phpt
@@ -0,0 +1,16 @@
+--TEST--\r
+Bug #76164 (exif_read_data zend_mm_heap corrupted)\r
+--SKIPIF--\r
+<?php\r
+if (!extension_loaded('exif')) die('skip exif extension not available');\r
+?>\r
+--FILE--\r
+<?php\r
+$var1 = 'nonexistentfile';\r
+$var2 = 2200000000;\r
+@exif_read_data($var1, $var2); // we're not interested in the warning, here\r
+$var2 = 1;\r
+?>\r
+===DONE===\r
+--EXPECT--\r
+===DONE===\r