diff -Naur php-5.3.29-original/ext/exif/exif.c php-5.3.29/ext/exif/exif.c --- php-5.3.29-original/ext/exif/exif.c 2015-01-25 09:16:22.648788988 +0000 +++ php-5.3.29/ext/exif/exif.c 2015-01-25 09:18:41.496792186 +0000 @@ -2722,7 +2722,7 @@ static int exif_process_unicode(image_info_type *ImageInfo, xp_field_type *xp_field, int tag, char *szValuePtr, int ByteCount TSRMLS_DC) { xp_field->tag = tag; - + xp_field->value = NULL; /* Copy the comment */ #if EXIF_USE_MBSTRING /* What if MS supports big-endian with XP? */ diff -Naur php-5.3.29-original/ext/exif/tests/bug68799.jpg php-5.3.29/ext/exif/tests/bug68799.jpg --- php-5.3.29-original/ext/exif/tests/bug68799.jpg 1970-01-01 00:00:00.000000000 +0000 +++ php-5.3.29/ext/exif/tests/bug68799.jpg 2015-01-25 09:17:00.859789868 +0000 @@ -0,0 +1,9 @@ +JFIF@ABCDEFGfExifMM*>F(N``paint.net 4.0.3C  + + + +    C  " + }!1AQa"q2#BR$3br +%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz + w!1AQaq"2B #3Rbr +$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ?( \ No newline at end of file diff -Naur php-5.3.29-original/ext/exif/tests/bug68799.phpt php-5.3.29/ext/exif/tests/bug68799.phpt --- php-5.3.29-original/ext/exif/tests/bug68799.phpt 1970-01-01 00:00:00.000000000 +0000 +++ php-5.3.29/ext/exif/tests/bug68799.phpt 2015-01-25 09:17:00.861789868 +0000 @@ -0,0 +1,63 @@ +--TEST-- +Bug #68799 (Free called on unitialized pointer) +--SKIPIF-- + +--FILE-- +a = $a . $a . $a . $a . $a . $a; + } +}; + +function doStuff ($limit) { + + $a = new A; + + $b = array(); + for ($i = 0; $i < $limit; $i++) { + $b[$i] = clone $a; + } + + unset($a); + + gc_collect_cycles(); +} + +$iterations = 3; + +doStuff($iterations); +doStuff($iterations); + +gc_collect_cycles(); + +print_r(exif_read_data(__DIR__.'/bug68799.jpg')); + +?> +--EXPECTF-- +Array +( + [FileName] => bug68799.jpg + [FileDateTime] => %d + [FileSize] => 735 + [FileType] => 2 + [MimeType] => image/jpeg + [SectionsFound] => ANY_TAG, IFD0, WINXP + [COMPUTED] => Array + ( + [html] => width="1" height="1" + [Height] => 1 + [Width] => 1 + [IsColor] => 1 + [ByteOrderMotorola] => 1 + ) + + [XResolution] => 96/1 + [YResolution] => 96/1 + [ResolutionUnit] => 2 + [Author] => +)