Fixed bug #68676 (Explicit Double Free)

diff --git a/NEWS b/NEWS
index 8d6fdff92ba9775ccd19c4ef856ae97da4f525a3..8bcb236ef9d3c248faef720986730d75e426e5db 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,4 +1,4 @@
-PHP                                                                        NEWS
+PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2014, PHP 5.5.21
 
@@ -16,6 +16,7 @@ PHP                                                                        NEWS
   . Fixed bug #68583 (Crash in timeout thread). (Anatol)
   . Fixed bug #68594 (Use after free vulnerability in unserialize()).
     (CVE-2014-8142) (Stefan Esser)
+  . Fixed bug #68676 (Explicit Double Free). (Kalle)
 
 - cURL:
   . Fixed bug #67643 (curl_multi_getcontent returns '' when

diff --git a/Zend/zend_ts_hash.c b/Zend/zend_ts_hash.c
index 6f2eb8185c545cb9d50916d688c98179da03890b..bf6ed4f2f12df386021e39da1828d152c6d3b45a 100644 (file)
--- a/Zend/zend_ts_hash.c
+++ b/Zend/zend_ts_hash.c
@@ -151,7 +151,7 @@ ZEND_API void zend_ts_hash_graceful_destroy(TsHashTable *ht)
 
 #ifdef ZTS
        tsrm_mutex_free(ht->mx_reader);
-       tsrm_mutex_free(ht->mx_reader);
+       tsrm_mutex_free(ht->mx_writer);
 #endif
 }