Fix double free in formatted_print.c

bwoebi · bwoebi · commit aa8cac578e22 · 2015-12-06T02:54:28.000+01:00
diff --git a/NEWS b/NEWS
@@ -27,6 +27,7 @@ PHP                                                                        NEWS
   . Fixed bug #70987 (static::class within Closure::call() causes segfault).
     (Andrea)
   . Fixed bug #71013 (Incorrect exception handler with yield from). (Bob)
+  . Fixed double free in error condition of format printer. (Bob)
 
 - CLI server:
   . Fixed bug #71005 (Segfault in php_cli_server_dispatch_router()). (Adam)
diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c
@@ -518,9 +518,6 @@ php_formatted_print(zend_execute_data *execute_data, int use_array, int format_o
 							efree(newargs);
 						}
 						php_error_docref(NULL, E_WARNING, "Width must be greater than zero and less than %d", INT_MAX);
-						if (newargs) {
-							efree(newargs);
-						}
 						return NULL;
 					}
 					adjusting |= ADJ_WIDTH;
@@ -540,9 +537,6 @@ php_formatted_print(zend_execute_data *execute_data, int use_array, int format_o
 								efree(newargs);
 							}
 							php_error_docref(NULL, E_WARNING, "Precision must be greater than zero and less than %d", INT_MAX);
-							if (newargs) {
-								efree(newargs);
-							}
 							return NULL;
 						}
 						adjusting |= ADJ_PRECISION;

Original file line number	Diff line number	Diff line change
`@@ -518,9 +518,6 @@ php_formatted_print(zend_execute_data *execute_data, int use_array, int format_o`
`518`	`518`	`efree(newargs);`
`519`	`519`	`}`
`520`	`520`	`php_error_docref(NULL, E_WARNING, "Width must be greater than zero and less than %d", INT_MAX);`
`521`		`- if (newargs) {`
`522`		`- efree(newargs);`
`523`		`- }`
`524`	`521`	`return NULL;`
`525`	`522`	`}`
`526`	`523`	`adjusting \|= ADJ_WIDTH;`
`@@ -540,9 +537,6 @@ php_formatted_print(zend_execute_data *execute_data, int use_array, int format_o`
`540`	`537`	`efree(newargs);`
`541`	`538`	`}`
`542`	`539`	`php_error_docref(NULL, E_WARNING, "Precision must be greater than zero and less than %d", INT_MAX);`
`543`		`- if (newargs) {`
`544`		`- efree(newargs);`
`545`		`- }`
`546`	`540`	`return NULL;`
`547`	`541`	`}`
`548`	`542`	`adjusting \|= ADJ_PRECISION;`