Description

Pointer init_file is passed to a function free at phpdbg_prompt.c:368 by calling function after the referenced memory was deallocated at phpdbg_prompt.c:333 by passing as first parameter to function phpdbg_try_file_init at phpdbg_prompt.c:367.

1. In line 367 init_file is passed to function phpdbg_try_file_init and variable free_init (last parameter) is set to 1:
   

   php-src/sapi/phpdbg/phpdbg_prompt.c

   Lines 367 to 368 in 38bd305

   	phpdbg_try_file_init(init_file, strlen(init_file), 1);
   	free(init_file);

2. Then init_file is freed in function phpdbg_try_file_init:
   

   php-src/sapi/phpdbg/phpdbg_prompt.c

   Lines 332 to 334 in 38bd305

   	if (free_init) {
   	free(init_file);
   	}

3. init_file is freed again in line 368:
   

   php-src/sapi/phpdbg/phpdbg_prompt.c

   Lines 367 to 368 in 38bd305

   	phpdbg_try_file_init(init_file, strlen(init_file), 1);
   	free(init_file);

This is probably a small typo, as there is a counterexample here (free_init is set to 0):

Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE.
Author A. Burke.

PHP Version

PHP 8.2.3

Operating System

No response