Fix double free in formatted_print.c

php · aa8cac578e22e65ceda63d3518d696ccfc920494 · bwoebi committed Dec 6, 2015 · Dec 6, 2015 · aa8cac5
1 parent 559ede1
commit aa8cac578e22e65ceda63d3518d696ccfc920494
Unified Split

Showing with 1 addition and 6 deletions.

+1 −0 NEWS

+0 −6 ext/standard/formatted_print.c
diff --git a/NEWS b/NEWS
@@ -27,6 +27,7 @@ PHP                                                                        NEWS
   . Fixed bug #70987 (static::class within Closure::call() causes segfault).
     (Andrea)
   . Fixed bug #71013 (Incorrect exception handler with yield from). (Bob)
+  . Fixed double free in error condition of format printer. (Bob)
 
 - CLI server:
   . Fixed bug #71005 (Segfault in php_cli_server_dispatch_router()). (Adam)
diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c
@@ -518,9 +518,6 @@ php_formatted_print(zend_execute_data *execute_data, int use_array, int format_o
 							efree(newargs);
 						}
 						php_error_docref(NULL, E_WARNING, "Width must be greater than zero and less than %d", INT_MAX);
-						if (newargs) {
-							efree(newargs);
-						}
 						return NULL;
 					}
 					adjusting |= ADJ_WIDTH;
@@ -540,9 +537,6 @@ php_formatted_print(zend_execute_data *execute_data, int use_array, int format_o
 								efree(newargs);
 							}
 							php_error_docref(NULL, E_WARNING, "Precision must be greater than zero and less than %d", INT_MAX);
-							if (newargs) {
-								efree(newargs);
-							}
 							return NULL;
 						}
 						adjusting |= ADJ_PRECISION;