diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2017-07-23 11:55:00 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2017-07-23 11:55:26 +0200 |
| commit | 9af5b7f33d58c20a6770ae2d9e6cc9fc7f011374 (patch) | |
| tree | 231cc51fac2bb106dcab1bcd73c618da7de823de | |
| parent | 47334646dbc0a6b62870a65bdc79bb61ff1529d5 (diff) | |
| download | php-git-9af5b7f33d58c20a6770ae2d9e6cc9fc7f011374.tar.gz | |
Fix use after free in mb_send_mail
| -rw-r--r-- | ext/mbstring/mbstring.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c index 3edaf87f66..5fcd17dd4f 100644 --- a/ext/mbstring/mbstring.c +++ b/ext/mbstring/mbstring.c @@ -4685,10 +4685,10 @@ PHP_FUNCTION(mb_send_mail) p = ZSTR_VAL(str_headers); n = ZSTR_LEN(str_headers); mbfl_memory_device_strncat(&device, p, n); - zend_string_release(str_headers); if (n > 0 && p[n - 1] != '\n') { mbfl_memory_device_strncat(&device, "\n", 1); } + zend_string_release(str_headers); } if (!zend_hash_str_exists(&ht_headers, "MIME-VERSION", sizeof("MIME-VERSION") - 1)) { |