From: Nikita Popov <nikita.ppv@gmail.com>
Date: Sun, 23 Jul 2017 09:55:00 +0000 (+0200)
Subject: Fix use after free in mb_send_mail
X-Git-Tag: php-7.2.0beta2~66
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=9af5b7f33d58c20a6770ae2d9e6cc9fc7f011374;p=php

Fix use after free in mb_send_mail
---

diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index 3edaf87f66..5fcd17dd4f 100644
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -4685,10 +4685,10 @@ PHP_FUNCTION(mb_send_mail)
 		p = ZSTR_VAL(str_headers);
 		n = ZSTR_LEN(str_headers);
 		mbfl_memory_device_strncat(&device, p, n);
-		zend_string_release(str_headers);
 		if (n > 0 && p[n - 1] != '\n') {
 			mbfl_memory_device_strncat(&device, "\n", 1);
 		}
+		zend_string_release(str_headers);
 	}
 
 	if (!zend_hash_str_exists(&ht_headers, "MIME-VERSION", sizeof("MIME-VERSION") - 1)) {