Fix use after free() in XMLReader::xml()

diff --git a/ext/xmlreader/php_xmlreader.c b/ext/xmlreader/php_xmlreader.c
index 80ce3d7e3af2509f9a38df736f40736a30245510..b9f6348c04a95e74a4507d7e827a40f2db4e2a68 100644 (file)
--- a/ext/xmlreader/php_xmlreader.c
+++ b/ext/xmlreader/php_xmlreader.c
@@ -30,6 +30,7 @@
 #ifdef HAVE_DOM
 #include "ext/dom/xml_common.h"
 #endif
+#include <libxml/xmlreader.h>
 #include <libxml/uri.h>
 
 zend_class_entry *xmlreader_class_entry;
@@ -1091,9 +1092,7 @@ PHP_METHOD(xmlreader, XML)
                        uri = (char *) xmlCanonicPath((const xmlChar *) resolved_path);
                }
                reader = xmlNewTextReader(inputbfr, uri);
-               if (uri) {
-                       xmlFree(uri);
-               }
+
                if (reader != NULL) {
 #if LIBXML_VERSION >= 20628
                        ret = xmlTextReaderSetup(reader, NULL, uri, encoding, options);
@@ -1107,11 +1106,20 @@ PHP_METHOD(xmlreader, XML)
                                }
                                intern->input = inputbfr;
                                intern->ptr = reader;
+
+                               if (uri) {
+                                       xmlFree(uri);
+                               }
+
                                return;
                        }
                }
        }
 
+       if (uri) {
+               xmlFree(uri);
+       }
+
        if (inputbfr) {
                xmlFreeParserInputBuffer(inputbfr);
        }