From: Nikita Popov <nikita.ppv@gmail.com>
Date: Sat, 28 Oct 2017 14:44:32 +0000 (+0200)
Subject: Fix invalid read in mb_ord()
X-Git-Tag: php-7.3.0alpha1~1159^2~11
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=251c1b1a44f1150b27c682ab0c183a1b3aa4b2ea;p=php

Fix invalid read in mb_ord()
---

diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index 7bb4304aff..40938d88e8 100644
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -4838,14 +4838,15 @@ static inline zend_long php_mb_ord(const char* str, size_t str_len, const char*
 
 		mbfl_convert_filter_feed_string(filter, (const unsigned char *) str, str_len);
 		mbfl_convert_filter_flush(filter);
-		mbfl_convert_filter_delete(filter);
 
 		if (dev.pos < 1 || filter->num_illegalchar || dev.buffer[0] >= MBFL_WCSGROUP_UCS4MAX) {
+			mbfl_convert_filter_delete(filter);
 			mbfl_wchar_device_clear(&dev);
 			return -1;
 		}
 
 		cp = dev.buffer[0];
+		mbfl_convert_filter_delete(filter);
 		mbfl_wchar_device_clear(&dev);
 		return cp;
 	}