Merge branch 'PHP-8.1'

Author: smalyshev

ext/filter/logical_filters.c

@@ -444,10 +444,10 @@ void php_filter_float(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
 
 	switch (is_numeric_string(num, p - num, &lval, &dval, 0)) {
 		case IS_LONG:
-			zval_ptr_dtor(value);
 			if ((min_range_set && (lval < min_range)) || (max_range_set && (lval > max_range))) {
 				goto error;
 			}
+			zval_ptr_dtor(value);
 			ZVAL_DOUBLE(value, (double)lval);
 			break;
 		case IS_DOUBLE:

ext/filter/tests/bug81708.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #81708 (UAF due to php_filter_float() failing for ints)
+--EXTENSIONS--
+filter
+--INI--
+opcache.enable_cli=0
+--FILE--
+<?php
+$input = "+" . str_repeat("1", 2); // avoid string interning
+filter_var(
+    $input,
+    FILTER_VALIDATE_FLOAT,
+    ["options" => ['min_range' => -1, 'max_range' => 1]]
+);
+var_dump($input);
+?>
+--EXPECT--
+string(3) "+11"