Double free of init_file in phpdbg_prompt.c

[burkeartem]

Description

Pointer init_file is passed to a function free at phpdbg_prompt.c:368 by calling function after the referenced memory was deallocated at phpdbg_prompt.c:333 by passing as first parameter to function phpdbg_try_file_init at phpdbg_prompt.c:367.

1. In line 367 init_file is passed to function phpdbg_try_file_init and variable free_init (last parameter) is set to 1:
   

   php-src/sapi/phpdbg/phpdbg_prompt.c

   Lines 367 to 368 in 38bd305

   	phpdbg_try_file_init(init_file, strlen(init_file), 1);
   	free(init_file);

2. Then init_file is freed in function phpdbg_try_file_init:
   

   php-src/sapi/phpdbg/phpdbg_prompt.c

   Lines 332 to 334 in 38bd305

   	if (free_init) {
   	free(init_file);
   	}

3. init_file is freed again in line 368:
   

   php-src/sapi/phpdbg/phpdbg_prompt.c

   Lines 367 to 368 in 38bd305

   	phpdbg_try_file_init(init_file, strlen(init_file), 1);
   	free(init_file);

This is probably a small typo, as there is a counterexample here (free_init is set to 0):

php-src/sapi/phpdbg/phpdbg_prompt.c

Lines 348 to 349 in 38bd305

	phpdbg_try_file_init(sys_ini, strlen(sys_ini), 0);
	free(sys_ini);

Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE.
Author A. Burke.

PHP Version

PHP 8.2.3

Operating System

No response

[ndossche]

Thanks for the report. This is a true positive as I was able to create a reproducer. PR coming soon.