From: Anatol Belski <ab@php.net>
Date: Tue, 22 Nov 2016 01:28:45 +0000 (+0100)
Subject: fix invalid read, follow up on 97b65cc9
X-Git-Tag: php-7.0.14RC1~6
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b52fa5882a276c9397d108cd690721a006acd827;p=php

fix invalid read, follow up on 97b65cc9
---

diff --git a/Zend/zend_ini_parser.y b/Zend/zend_ini_parser.y
index 5e38defb15..458808eb85 100644
--- a/Zend/zend_ini_parser.y
+++ b/Zend/zend_ini_parser.y
@@ -109,16 +109,16 @@ static void zend_ini_init_string(zval *result)
 static void zend_ini_add_string(zval *result, zval *op1, zval *op2)
 {
 	int length, op1_len;
+	zend_string *str = NULL;
 
 	if (Z_TYPE_P(op1) != IS_STRING) {
-		zend_string *str = zval_get_string(op1);
+		str = zval_get_string(op1);
 		/* ZEND_ASSERT(!Z_REFCOUNTED_P(op1)); */
 		if (ZEND_SYSTEM_INI) {
 			ZVAL_PSTRINGL(op1, ZSTR_VAL(str), ZSTR_LEN(str));
 		} else {
 			ZVAL_STR(op1, str);
 		}
-		zend_string_release(str);
 	}
 	op1_len = (int)Z_STRLEN_P(op1);
 	
@@ -129,6 +129,10 @@ static void zend_ini_add_string(zval *result, zval *op1, zval *op2)
 
 	ZVAL_NEW_STR(result, zend_string_extend(Z_STR_P(op1), length, ZEND_SYSTEM_INI));
 	memcpy(Z_STRVAL_P(result) + op1_len, Z_STRVAL_P(op2), Z_STRLEN_P(op2) + 1);
+
+	if (str) {
+		zend_string_release(str);
+	}
 }
 /* }}} */