Fix bug #67349: Locale::parseLocale Double Free

diff --git a/ext/intl/locale/locale_methods.c b/ext/intl/locale/locale_methods.c
index 21b5847f2d339428642b5060ef3c824d57f5d877..8eb663cb167d6044f6051a3e2fd9952c3c213982 100644 (file)
--- a/ext/intl/locale/locale_methods.c
+++ b/ext/intl/locale/locale_methods.c
@@ -269,8 +269,7 @@ static char* get_icu_value_internal( const char* loc_name , char* tag_name, int*
                grOffset =  findOffset( LOC_GRANDFATHERED , loc_name );
                if( grOffset >= 0 ){
                        if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
-                               tag_value = estrdup(loc_name);
-                               return tag_value;
+                               return estrdup(loc_name);
                        } else {
                                /* Since Grandfathered , no value , do nothing , retutn NULL */
                                return NULL;
@@ -280,8 +279,8 @@ static char* get_icu_value_internal( const char* loc_name , char* tag_name, int*
        if( fromParseLocale==1 ){
                /* Handle singletons */
                if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
-                       if( strlen(loc_name)>1 && (isIDPrefix(loc_name) ==1 ) ){
-                               return (char *)loc_name;
+                       if( strlen(loc_name)>1 && (isIDPrefix(loc_name) == 1)){
+                               return estrdup(loc_name);
                        }
                }
 

diff --git a/ext/intl/tests/locale_parse_locale2.phpt b/ext/intl/tests/locale_parse_locale2.phpt
index 6012862a48928154d791bc693d00d2f2a772588a..30cc8cc0ae5a88d76003787afe6aea15578fdd55 100644 (file)
--- a/ext/intl/tests/locale_parse_locale2.phpt
+++ b/ext/intl/tests/locale_parse_locale2.phpt
@@ -63,7 +63,8 @@ function ut_main()
 //Some Invalid Tags:
         'de-419-DE',
         'a-DE',
-        'ar-a-aaa-b-bbb-a-ccc'
+        'ar-a-aaa-b-bbb-a-ccc',
+       'x-AAAAAA',
     );
 
 
@@ -201,3 +202,6 @@ No values found from Locale parsing.
 ---------------------
 ar-a-aaa-b-bbb-a-ccc:
 language : 'ar' ,
+---------------------
+x-AAAAAA:
+private0 : 'AAAAAA' ,