Another user-after-free vulnerability was found in unserialize(). We can create ZVAL and free it. During deserialization it will still allow to use R: or r: to set references to already freed memory, which could possibly lead to remote code execution.

Vulnerable code:

ALLOC_INIT_ZVAL(pentry);
if (!php_var_unserialize(&pentry, &p, s + buf_len, &var_hash TSRMLS_CC)) {
	zval_ptr_dtor(&pentry);
	goto outexcept;
}
var_push_dtor(&var_hash, &pentry);
if(Z_TYPE_P(pentry) != IS_OBJECT) {
	goto outexcept;
}
ALLOC_INIT_ZVAL(pinf);
if (*p == ',') { /* new version has inf */
	++p;
	if (!php_var_unserialize(&pinf, &p, s + buf_len, &var_hash TSRMLS_CC)) {
		zval_ptr_dtor(&pinf);
		goto outexcept;
	}
}

Upstream report:

https://bugs.php.net/bug.php?id=70365

Upstream patch:

http://git.php.net/?p=php-src.git;a=commit;h=f06a069c462d37c2e009f6d1d93b8c8e7b713393