From: Nikita Popov Date: Sun, 23 Jul 2017 09:55:00 +0000 (+0200) Subject: Fix use after free in mb_send_mail X-Git-Tag: php-7.2.0beta2~66 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=9af5b7f33d58c20a6770ae2d9e6cc9fc7f011374;p=php Fix use after free in mb_send_mail --- diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c index 3edaf87f66..5fcd17dd4f 100644 --- a/ext/mbstring/mbstring.c +++ b/ext/mbstring/mbstring.c @@ -4685,10 +4685,10 @@ PHP_FUNCTION(mb_send_mail) p = ZSTR_VAL(str_headers); n = ZSTR_LEN(str_headers); mbfl_memory_device_strncat(&device, p, n); - zend_string_release(str_headers); if (n > 0 && p[n - 1] != '\n') { mbfl_memory_device_strncat(&device, "\n", 1); } + zend_string_release(str_headers); } if (!zend_hash_str_exists(&ht_headers, "MIME-VERSION", sizeof("MIME-VERSION") - 1)) {