- Fix bug #32245 (xml_parser_free() in function assigned to the xml parser

  gives a segfault)

diff --git a/ext/xml/php_xml.h b/ext/xml/php_xml.h
index 1864937b04f8c6495bcb8b47207bed3bd8bbc11c..d8e71c18f0c1d68736091c94662d59a18f644cbb 100644 (file)
--- a/ext/xml/php_xml.h
+++ b/ext/xml/php_xml.h
@@ -90,6 +90,7 @@ typedef struct {
        char **ltags;
        int lastwasopen;
        int skipwhite;
+       int isparsing;
        
        XML_Char *baseURI;
 } xml_parser;

diff --git a/ext/xml/xml.c b/ext/xml/xml.c
index d77ebb1dda0401743664e3e50eff566ee3a97691..b2d4beef2c6cb7f6d3f2c471d29b03b6d55e64f6 100644 (file)
--- a/ext/xml/xml.c
+++ b/ext/xml/xml.c
@@ -1076,6 +1076,8 @@ static void php_xml_parser_create_impl(INTERNAL_FUNCTION_PARAMETERS, int ns_supp
        parser->target_encoding = encoding;
        parser->case_folding = 1;
        parser->object = NULL;
+       parser->isparsing = 0;
+
        XML_SetUserData(parser->parser, parser);
 
        ZEND_REGISTER_RESOURCE(return_value, parser,le_xml_parser);
@@ -1334,7 +1336,9 @@ PHP_FUNCTION(xml_parse)
                isFinal = 0;
        }
 
+       parser->isparsing = 1;
        ret = XML_Parse(parser->parser, Z_STRVAL_PP(data), Z_STRLEN_PP(data), isFinal);
+       parser->isparsing = 0;
        RETVAL_LONG(ret);
 }
 
@@ -1373,7 +1377,9 @@ PHP_FUNCTION(xml_parse_into_struct)
        XML_SetElementHandler(parser->parser, _xml_startElementHandler, _xml_endElementHandler);
        XML_SetCharacterDataHandler(parser->parser, _xml_characterDataHandler);
 
+       parser->isparsing = 1;
        ret = XML_Parse(parser->parser, Z_STRVAL_PP(data), Z_STRLEN_PP(data), 1);
+       parser->isparsing = 0;
 
        RETVAL_LONG(ret);
 }
@@ -1474,6 +1480,11 @@ PHP_FUNCTION(xml_parser_free)
 
        ZEND_FETCH_RESOURCE(parser,xml_parser *, pind, -1, "XML Parser", le_xml_parser);
 
+       if (parser->isparsing == 1) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Parser cannot be freed while it is parsing.");
+               RETURN_FALSE;
+       }
+
        if (zend_list_delete(parser->index) == FAILURE) {
                RETURN_FALSE;
        }