From: Stanislav Malyshev <stas@php.net>
Date: Wed, 4 Jun 2014 08:06:01 +0000 (-0700)
Subject: Fix bug #67349: Locale::parseLocale Double Free
X-Git-Tag: PRE_PHPNG_MERGE~164
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=5ecee6ebce576142fd13d2d1ec0bd52dac3086f9;p=php

Fix bug #67349: Locale::parseLocale Double Free
---

diff --git a/ext/intl/locale/locale_methods.c b/ext/intl/locale/locale_methods.c
index 21b5847f2d..8eb663cb16 100644
--- a/ext/intl/locale/locale_methods.c
+++ b/ext/intl/locale/locale_methods.c
@@ -269,8 +269,7 @@ static char* get_icu_value_internal( const char* loc_name , char* tag_name, int*
 		grOffset =  findOffset( LOC_GRANDFATHERED , loc_name );
 		if( grOffset >= 0 ){
 			if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
-				tag_value = estrdup(loc_name);
-				return tag_value;
+				return estrdup(loc_name);
 			} else {
 				/* Since Grandfathered , no value , do nothing , retutn NULL */
 				return NULL;
@@ -280,8 +279,8 @@ static char* get_icu_value_internal( const char* loc_name , char* tag_name, int*
 	if( fromParseLocale==1 ){
 		/* Handle singletons */
 		if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
-			if( strlen(loc_name)>1 && (isIDPrefix(loc_name) ==1 ) ){
-				return (char *)loc_name;
+			if( strlen(loc_name)>1 && (isIDPrefix(loc_name) == 1)){
+				return estrdup(loc_name);
 			}
 		}
 
diff --git a/ext/intl/tests/locale_parse_locale2.phpt b/ext/intl/tests/locale_parse_locale2.phpt
index 6012862a48..30cc8cc0ae 100644
--- a/ext/intl/tests/locale_parse_locale2.phpt
+++ b/ext/intl/tests/locale_parse_locale2.phpt
@@ -63,7 +63,8 @@ function ut_main()
 //Some Invalid Tags:
         'de-419-DE',
         'a-DE',
-        'ar-a-aaa-b-bbb-a-ccc'
+        'ar-a-aaa-b-bbb-a-ccc',
+	'x-AAAAAA',
     );
 
 
@@ -201,3 +202,6 @@ No values found from Locale parsing.
 ---------------------
 ar-a-aaa-b-bbb-a-ccc:
 language : 'ar' ,
+---------------------
+x-AAAAAA:
+private0 : 'AAAAAA' ,