Fix #78665: Multicasting may leak memory

diff --git a/NEWS b/NEWS
index 972a22fc84cad489709d45171394d308734704b9..52a495287deedb2a6370c9c1cc24250ea98a4783 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,9 @@ PHP                                                                        NEWS
   . Fixed bug #78642 (Wrong libiconv version displayed). (gedas at martynas,
     cmb).
 
+- Sockets:
+  . Fixed bug #78665 (Multicasting may leak memory). (cmb)
+
 24 Oct 2019, PHP 7.2.24
 
 - Core:

diff --git a/ext/sockets/multicast.c b/ext/sockets/multicast.c
index e32b2d8457a21a426523137defb3ff8ea343d338..672e34e1d32f5f727db61381ca92c8bd5bd50b54 100644 (file)
--- a/ext/sockets/multicast.c
+++ b/ext/sockets/multicast.c
@@ -652,6 +652,7 @@ retry:
                goto retry;
        }
        if (retval != NO_ERROR) {
+               efree(addr_table);
                php_error_docref(NULL, E_WARNING,
                        "GetIpAddrTable failed with error %lu", retval);
                return FAILURE;
@@ -660,9 +661,11 @@ retry:
                MIB_IPADDRROW r = addr_table->table[i];
                if (r.dwIndex == if_index) {
                        out_addr->s_addr = r.dwAddr;
+                       efree(addr_table);
                        return SUCCESS;
                }
        }
+       efree(addr_table);
        php_error_docref(NULL, E_WARNING,
                "No interface with index %u was found", if_index);
        return FAILURE;
@@ -692,6 +695,7 @@ retry:
                goto retry;
        }
        if (retval != NO_ERROR) {
+               efree(addr_table);
                php_error_docref(NULL, E_WARNING,
                        "GetIpAddrTable failed with error %lu", retval);
                return FAILURE;
@@ -700,9 +704,11 @@ retry:
                MIB_IPADDRROW r = addr_table->table[i];
                if (r.dwAddr == addr->s_addr) {
                        *if_index = r.dwIndex;
+                       efree(addr_table);
                        return SUCCESS;
                }
        }
+       efree(addr_table);
 
        {
                char addr_str[17] = {0};