Skip to content

Commit d3d6d79

Browse files
committed
Fix #76167: mbstring may use pointer from some previous request
We must not reuse per-request memory across multiple requests, so this check triggered during RINIT makes no sense. As explained in the bug report[1], it can be even harmful, if some request startup fails, and the pointers refer to already freed memory in the next request. [1] <https://bugs.php.net/76167> Closes GH-7604.
1 parent 56495ac commit d3d6d79

File tree

2 files changed

+4
-4
lines changed

2 files changed

+4
-4
lines changed

NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@ PHP NEWS
1414
. Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege
1515
escalation) (CVE-2021-21703). (Jakub Zelenka)
1616

17+
- MBString:
18+
. Fixed bug #76167 (mbstring may use pointer from some previous request).
19+
(cmb, cataphract)
20+
1721
- MySQLi:
1822
. Fixed bug #81494 (Stopped unbuffered query does not throw error). (Nikita)
1923

ext/mbstring/mbstring.c

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5208,10 +5208,6 @@ static void php_mb_populate_current_detect_order_list(void)
52085208
const mbfl_encoding **entry = 0;
52095209
size_t nentries;
52105210

5211-
if (MBSTRG(current_detect_order_list)) {
5212-
return;
5213-
}
5214-
52155211
if (MBSTRG(detect_order_list) && MBSTRG(detect_order_list_size)) {
52165212
nentries = MBSTRG(detect_order_list_size);
52175213
entry = (const mbfl_encoding **)safe_emalloc(nentries, sizeof(mbfl_encoding*), 0);

0 commit comments

Comments
 (0)