diff --git a/ext/standard/tests/filters/gh17037.phpt b/ext/standard/tests/filters/gh17037.phpt new file mode 100644 index 0000000000000..21319ba26bf99 --- /dev/null +++ b/ext/standard/tests/filters/gh17037.phpt @@ -0,0 +1,8 @@ +--TEST-- +GH-17037 (UAF in user filter when adding existing filter name due to incorrect error handling) +--FILE-- + +--EXPECT-- +bool(false) diff --git a/ext/standard/user_filters.c b/ext/standard/user_filters.c index 50b1b0ae0d588..fcbc09c645882 100644 --- a/ext/standard/user_filters.c +++ b/ext/standard/user_filters.c @@ -521,13 +521,17 @@ PHP_FUNCTION(stream_filter_register) fdat = ecalloc(1, sizeof(struct php_user_filter_data)); fdat->classname = zend_string_copy(classname); - if (zend_hash_add_ptr(BG(user_filter_map), filtername, fdat) != NULL && - php_stream_filter_register_factory_volatile(filtername, &user_filter_factory) == SUCCESS) { - RETVAL_TRUE; + if (zend_hash_add_ptr(BG(user_filter_map), filtername, fdat) != NULL) { + if (php_stream_filter_register_factory_volatile(filtername, &user_filter_factory) == SUCCESS) { + RETURN_TRUE; + } + + zend_hash_del(BG(user_filter_map), filtername); } else { zend_string_release_ex(classname, 0); efree(fdat); - RETVAL_FALSE; } + + RETURN_FALSE; } /* }}} */