Merge branch 'PHP-8.0' into PHP-8.1

devnexen · devnexen · commit 75743eaf1bc8 · 2022-06-16T12:41:51.000+01:00
diff --git a/NEWS b/NEWS
@@ -66,6 +66,7 @@ PHP                                                                        NEWS
   . Fixed ACL build check on MacOS. (David Carlier)
   . Fixed bug #72185: php-fpm writes empty fcgi record causing nginx 502.
     (Jakub Zelenka, loveharmful)
+  . Fixes use after free. (Heiko Weber).
 
 - mysqlnd:
   . Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
diff --git a/sapi/fpm/fpm/fpm_conf.c b/sapi/fpm/fpm/fpm_conf.c
@@ -769,8 +769,8 @@ static int fpm_evaluate_full_path(char **path, struct fpm_worker_pool_s *wp, cha
 			}
 
 			if (strlen(*path) > strlen("$prefix")) {
-				free(*path);
 				tmp = strdup((*path) + strlen("$prefix"));
+				free(*path);
 				*path = tmp;
 			} else {
 				free(*path);

Original file line number	Diff line number	Diff line change
`@@ -769,8 +769,8 @@ static int fpm_evaluate_full_path(char *path, struct fpm_worker_pool_s wp, cha`
`769`	`769`	`}`
`770`	`770`
`771`	`771`	`if (strlen(*path) > strlen("$prefix")) {`
`772`		`- free(*path);`
`773`	`772`	`tmp = strdup((*path) + strlen("$prefix"));`
	`773`	`+ free(*path);`
`774`	`774`	`*path = tmp;`
`775`	`775`	`} else {`
`776`	`776`	`free(*path);`