Fix use after free() in XMLReader::xml()

diff --git a/ext/xmlreader/php_xmlreader.c b/ext/xmlreader/php_xmlreader.c
index d029f5efcad99b8176d741faf352c6cf3b7881cb..9b9f8521690e1c906539de4a491490c0d0451cac 100644 (file)
--- a/ext/xmlreader/php_xmlreader.c
+++ b/ext/xmlreader/php_xmlreader.c
@@ -1092,9 +1092,7 @@ PHP_METHOD(xmlreader, XML)
                        uri = (char *) xmlCanonicPath((const xmlChar *) resolved_path);
                }
                reader = xmlNewTextReader(inputbfr, uri);
-               if (uri) {
-                       xmlFree(uri);
-               }
+
                if (reader != NULL) {
 #if LIBXML_VERSION >= 20628
                        ret = xmlTextReaderSetup(reader, NULL, uri, encoding, options);
@@ -1108,11 +1106,20 @@ PHP_METHOD(xmlreader, XML)
                                }
                                intern->input = inputbfr;
                                intern->ptr = reader;
+
+                               if (uri) {
+                                       xmlFree(uri);
+                               }
+
                                return;
                        }
                }
        }
 
+       if (uri) {
+               xmlFree(uri);
+       }
+
        if (inputbfr) {
                xmlFreeParserInputBuffer(inputbfr);
        }