Fixed bug #33958 (duplicate cookies and magic_quotes=off may cause a crash)

Author: Ilia Alshanetsky

NEWS

@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? ??? 2005, PHP 5.1
 - Fixed bug #33967 (misuse of Exception constructor doesn't display errorfile).
   (Jani)
+- Fixed bug #33958 (duplicate cookies and magic_quotes=off may cause a crash).
+  (Ilia)
 - Fixed bug #33917 (number_format() output with > 1 char separators). (Jani)
 - Fixed bug #33904 (input array keys being escaped when magic quotes is off). 
   (Ilia)

main/php_variables.c

@@ -198,7 +198,9 @@ PHPAPI void php_register_variable_ex(char *var, zval *val, zval *track_vars_arra
 				 */
 				if (PG(http_globals)[TRACK_VARS_COOKIE] && symtable1 == Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_COOKIE]) && 
 					zend_symtable_find(symtable1, escaped_index, index_len+1, (void **) &tmp) != FAILURE) {
-					efree(escaped_index);
+					if (PG(magic_quotes_gpc)) { 
+						efree(escaped_index);
+					}
 					break;
 				}
 				zend_symtable_update(symtable1, escaped_index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);