diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c index 13ad7952b9864..3e59806b86750 100644 --- a/ext/mbstring/mbstring.c +++ b/ext/mbstring/mbstring.c @@ -1159,8 +1159,7 @@ PHP_RSHUTDOWN_FUNCTION(mbstring) if (MBSTRG(all_encodings_list)) { GC_DELREF(MBSTRG(all_encodings_list)); - zend_hash_destroy(MBSTRG(all_encodings_list)); - efree(MBSTRG(all_encodings_list)); + zend_array_destroy(MBSTRG(all_encodings_list)); MBSTRG(all_encodings_list) = NULL; } diff --git a/ext/mbstring/tests/mb_list_encodings_gc_uaf.phpt b/ext/mbstring/tests/mb_list_encodings_gc_uaf.phpt new file mode 100644 index 0000000000000..4a83372b16744 --- /dev/null +++ b/ext/mbstring/tests/mb_list_encodings_gc_uaf.phpt @@ -0,0 +1,9 @@ +--TEST-- +Use-after-free of MBSTRG(all_encodings_list) on shutdown +--EXTENSIONS-- +mbstring +--FILE-- + +--EXPECT--