Fixed bug #65593 (Segfault when calling ob_start from output buffering callback)

diff --git a/NEWS b/NEWS
index 079e077fe6a5a04e064aa7561d74f1e4b84b1528..5004990d31e93b1131ba1f7027259cc7c315f48f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? ??? 2015, PHP 5.5.23
 
 - Core:
+  . Fixed bug #65593 (Segfault when calling ob_start from output buffering 
+    callback). (Mike)
   . Fixed bug #69017 (Fail to push to the empty array with the constant value
     defined in class scope). (Laruence)
   . Added NULL byte protection to exec, system and passthru. (Yasuo)

diff --git a/main/output.c b/main/output.c
index f9b8a68a80740e690e21763788cc36330509d1ea..bb0f6bd68022369403eefc381613cd42ee4f236f 100644 (file)
--- a/main/output.c
+++ b/main/output.c
@@ -172,21 +172,22 @@ PHPAPI void php_output_deactivate(TSRMLS_D)
 {
        php_output_handler **handler = NULL;
 
-       php_output_header(TSRMLS_C);
+       if ((OG(flags) & PHP_OUTPUT_ACTIVATED)) {
+               php_output_header(TSRMLS_C);
 
-       OG(flags) ^= PHP_OUTPUT_ACTIVATED;
-       OG(active) = NULL;
-       OG(running) = NULL;
+               OG(flags) ^= PHP_OUTPUT_ACTIVATED;
+               OG(active) = NULL;
+               OG(running) = NULL;
 
-       /* release all output handlers */
-       if (OG(handlers).elements) {
-               while (SUCCESS == zend_stack_top(&OG(handlers), (void *) &handler)) {
-                       php_output_handler_free(handler TSRMLS_CC);
-                       zend_stack_del_top(&OG(handlers));
+               /* release all output handlers */
+               if (OG(handlers).elements) {
+                       while (SUCCESS == zend_stack_top(&OG(handlers), (void *) &handler)) {
+                               php_output_handler_free(handler TSRMLS_CC);
+                               zend_stack_del_top(&OG(handlers));
+                       }
+                       zend_stack_destroy(&OG(handlers));
                }
-               zend_stack_destroy(&OG(handlers));
        }
-
 }
 /* }}} */
 

diff --git a/tests/output/bug65593.phpt b/tests/output/bug65593.phpt
new file mode 100644 (file)
index 0000000..336c73e
--- /dev/null
+++ b/tests/output/bug65593.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #65593 (ob_start(function(){ob_start();});)
+--FILE--
+<?php 
+echo "Test\n";
+
+ob_start(function(){ob_start();});
+?>
+===DONE===
+--EXPECT--
+Test
+
+Fatal error: Cannot destroy active lambda function in /home/mike/src/php-5.5/tests/output/bug65593.php on line 4