Patch bug67349-patch for intl Bug #67349

Patch version 2014-06-08 19:57 UTC

• 2014-06-08 19:57 UTC [diff to current]

Developer: stas@php.net

commit 123d72277c6243874a8cd10424bb341821c437ff
Author: Stanislav Malyshev <stas@php.net>
Date:   Wed Jun 4 01:06:01 2014 -0700

    Fix bug #67349: Locale::parseLocale Double Free

diff --git a/NEWS b/NEWS
index b728638..0a01858 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,9 @@ PHP                                                                        NEWS
 - Fileinfo:
   . Fixed bug #67326 (fileinfo: cdf_read_short_sector insufficient boundary check).
 
+- Intl:
+  . Fixed bug #67349 (Locale::parseLocale Double Free). (Stas)
+
 - SPL:
   . Fixed bug #67359 (Segfault in recursiveDirectoryIterator). (Laruence)
   . Fixed bug #67360 (Missing element after ArrayObject::getIterator). (Adam)
diff --git a/ext/intl/locale/locale_methods.c b/ext/intl/locale/locale_methods.c
index 9c5b09a..f21bc6d 100644
--- a/ext/intl/locale/locale_methods.c
+++ b/ext/intl/locale/locale_methods.c
@@ -272,10 +272,8 @@ static char* get_icu_value_internal( char* loc_name , char* tag_name, int* resul
 		grOffset =  findOffset( LOC_GRANDFATHERED , loc_name );
 		if( grOffset >= 0 ){
 			if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
-				tag_value = estrdup(loc_name);
-				return tag_value;
+				return estrdup(loc_name);
 			} else {
-				/* Since Grandfathered , no value , do nothing , retutn NULL */
 				return NULL;
 			}
 		}
@@ -283,8 +281,8 @@ static char* get_icu_value_internal( char* loc_name , char* tag_name, int* resul
 	if( fromParseLocale==1 ){
 		/* Handle singletons */
 		if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
-			if( strlen(loc_name)>1 && (isIDPrefix(loc_name) ==1 ) ){
-				return loc_name;
+			if( strlen(loc_name)>1 && isIDPrefix(loc_name) ){
+				return estrdup(loc_name);
 			}
 		}
 
diff --git a/ext/intl/tests/locale_parse_locale2.phpt b/ext/intl/tests/locale_parse_locale2.phpt
index 6012862..30cc8cc 100644
--- a/ext/intl/tests/locale_parse_locale2.phpt
+++ b/ext/intl/tests/locale_parse_locale2.phpt
@@ -63,7 +63,8 @@ function ut_main()
 //Some Invalid Tags:
         'de-419-DE',
         'a-DE',
-        'ar-a-aaa-b-bbb-a-ccc'
+        'ar-a-aaa-b-bbb-a-ccc',
+	'x-AAAAAA',
     );
 
 
@@ -201,3 +202,6 @@ No values found from Locale parsing.
 ---------------------
 ar-a-aaa-b-bbb-a-ccc:
 language : 'ar' ,
+---------------------
+x-AAAAAA:
+private0 : 'AAAAAA' ,