Fix several egregious leaks in ext/browscap and sapi/embed.

diff --git a/NEWS b/NEWS
index 603bc7f10624723fa3eaa87383e882db1d8602e8..4643372392948e8c398e6c69a576ccf3918d6ecd 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, Version 4.3.11
+- Fixed several egregious leaks in ext/browscap and sapi/embed. (Andrei)
 - Added Oracle Instant Client support. (cjbj at hotmail dot com, Tony)
 - Changed phpize not to require libtool. (Jani)
 - Fixed build system to always use bundled libtool files. (Jani)  

diff --git a/ext/standard/browscap.c b/ext/standard/browscap.c
index 98b88cd37295eca7f78c7ad7d6b848e39471e7a2..ef78debfbe8b61552020991494328c48165ddce2 100644 (file)
--- a/ext/standard/browscap.c
+++ b/ext/standard/browscap.c
@@ -33,12 +33,17 @@ static zval *current_section;
 
 /* OBJECTS_FIXME: This whole extension needs going through. The use of objects looks pretty broken here */
 
-static void browscap_entry_dtor(zval *pvalue)
+static void browscap_entry_dtor(zval **pvalue)
 {
-       if (Z_TYPE_P(pvalue) == IS_ARRAY) {
-               zend_hash_destroy(Z_ARRVAL_P(pvalue));
-               free(Z_ARRVAL_P(pvalue));
+       if (Z_TYPE_PP(pvalue) == IS_ARRAY) {
+               zend_hash_destroy(Z_ARRVAL_PP(pvalue));
+               free(Z_ARRVAL_PP(pvalue));
+       } else if (Z_TYPE_PP(pvalue) == IS_STRING) {
+               if (Z_STRVAL_PP(pvalue) && Z_STRVAL_PP(pvalue) != empty_string) {
+                       free(Z_STRVAL_PP(pvalue));
+               }
        }
+       free(*pvalue);
 }
 
 /* {{{ convert_browscap_pattern
@@ -97,7 +102,7 @@ static void php_browscap_parser_cb(zval *arg1, zval *arg2, int callback_type, vo
 
                                new_property = (zval *) malloc(sizeof(zval));
                                INIT_PZVAL(new_property);
-                               Z_STRVAL_P(new_property) = Z_STRLEN_P(arg2)?zend_strndup(Z_STRVAL_P(arg2), Z_STRLEN_P(arg2)):"";
+                               Z_STRVAL_P(new_property) = Z_STRLEN_P(arg2)?zend_strndup(Z_STRVAL_P(arg2), Z_STRLEN_P(arg2)):empty_string;
                                Z_STRLEN_P(new_property) = Z_STRLEN_P(arg2);
                                Z_TYPE_P(new_property) = IS_STRING;
 
@@ -123,6 +128,7 @@ static void php_browscap_parser_cb(zval *arg1, zval *arg2, int callback_type, vo
                                section_properties = (HashTable *) malloc(sizeof(HashTable));
                                zend_hash_init(section_properties, 0, NULL, (dtor_func_t) browscap_entry_dtor, 1);
                                current_section->value.ht = section_properties;
+                               current_section->type = IS_ARRAY;
                                zend_hash_update(&browser_hash, Z_STRVAL_P(arg1), Z_STRLEN_P(arg1)+1, (void *) &current_section, sizeof(zval *), NULL);
 
                                Z_STRVAL_P(processed) = Z_STRVAL_P(arg1);

diff --git a/sapi/embed/php_embed.c b/sapi/embed/php_embed.c
index e1f644e011ff77bff16493981bc9570103ed56f8..44a8e362260b960fc8538002f97efa44fd7471ad 100644 (file)
--- a/sapi/embed/php_embed.c
+++ b/sapi/embed/php_embed.c
@@ -213,6 +213,7 @@ void php_embed_shutdown(TSRMLS_D)
 {
        php_request_shutdown((void *) 0);
        php_module_shutdown(TSRMLS_C);
+       sapi_shutdown();
 #ifdef ZTS
     tsrm_shutdown();
 #endif