Fixed bug #68901 (use after free)

laruence · smalyshev · commit 920a0afbf8f8 · 2015-04-11T16:28:07.000-07:00
diff --git a/NEWS b/NEWS
@@ -15,6 +15,9 @@ PHP                                                                        NEWS
 - Sqlite3:
   . Fixed bug #66550 (SQLite prepared statement use-after-free). (Sean Heelan)
 
+- Phar:
+  . Fixed bug #68901 (use after free). (bugreports at internot dot info)
+
 - Postgres:
   . Fixed bug #68741 (Null pointer deference) (CVE-2015-1352). (Xinchen Hui)
 
diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
@@ -2211,8 +2211,8 @@ static zval *phar_rename_archive(phar_archive_data *phar, char *ext, zend_bool c
 	}
 its_ok:
 	if (SUCCESS == php_stream_stat_path(newpath, &ssb)) {
-		efree(oldpath);
 		zend_throw_exception_ex(spl_ce_BadMethodCallException, 0 TSRMLS_CC, "phar \"%s\" exists and must be unlinked prior to conversion", newpath);
+		efree(oldpath);
 		return NULL;
 	}
 	if (!phar->is_data) {

Original file line number	Diff line number	Diff line change
`@@ -2211,8 +2211,8 @@ static zval phar_rename_archive(phar_archive_data phar, char *ext, zend_bool c`
`2211`	`2211`	`}`
`2212`	`2212`	`its_ok:`
`2213`	`2213`	`if (SUCCESS == php_stream_stat_path(newpath, &ssb)) {`
`2214`		`- efree(oldpath);`
`2215`	`2214`	`zend_throw_exception_ex(spl_ce_BadMethodCallException, 0 TSRMLS_CC, "phar \"%s\" exists and must be unlinked prior to conversion", newpath);`
	`2215`	`+ efree(oldpath);`
`2216`	`2216`	`return NULL;`
`2217`	`2217`	`}`
`2218`	`2218`	`if (!phar->is_data) {`