Fixed use after free

dstogov · dstogov · commit 0cf69234e9cd · 2016-11-22T13:28:27.000+03:00
diff --git a/Zend/zend_ini_parser.y b/Zend/zend_ini_parser.y
@@ -115,10 +115,10 @@ static void zend_ini_add_string(zval *result, zval *op1, zval *op2)
 		/* ZEND_ASSERT(!Z_REFCOUNTED_P(op1)); */
 		if (ZEND_SYSTEM_INI) {
 			ZVAL_PSTRINGL(op1, ZSTR_VAL(str), ZSTR_LEN(str));
+			zend_string_release(str);
 		} else {
 			ZVAL_STR(op1, str);
 		}
-		zend_string_release(str);
 	}
 	op1_len = (int)Z_STRLEN_P(op1);
 	

Original file line number	Diff line number	Diff line change
`@@ -115,10 +115,10 @@ static void zend_ini_add_string(zval result, zval op1, zval *op2)`
`115`	`115`	`/* ZEND_ASSERT(!Z_REFCOUNTED_P(op1)); */`
`116`	`116`	`if (ZEND_SYSTEM_INI) {`
`117`	`117`	`ZVAL_PSTRINGL(op1, ZSTR_VAL(str), ZSTR_LEN(str));`
	`118`	`+ zend_string_release(str);`
`118`	`119`	`} else {`
`119`	`120`	`ZVAL_STR(op1, str);`
`120`	`121`	`}`
`121`		`- zend_string_release(str);`
`122`	`122`	`}`
`123`	`123`	`op1_len = (int)Z_STRLEN_P(op1);`
`124`	`124`