MFH: - Fixed bug #43092 (curl_copy_handle() crashes with > 32 chars long URL)

diff --git a/NEWS b/NEWS
index 90f361659e7b6e1e6432efcc24370b5d5a644a5d..3a210ab85d65667ebd7b8690b571c030f59a37c2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,8 +1,10 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2008, PHP 5.2.6
-- Fixed bug #43301 (mb_ereg*_replace() crashes when replacement string is invalid
-  PHP expression and 'e' option is used). (Jani)
+- Fixed bug #43092 (curl_copy_handle() crashes with > 32 chars long URL).
+  (Jani)
+- Fixed bug #43301 (mb_ereg*_replace() crashes when replacement string is
+  invalid PHP expression and 'e' option is used). (Jani)
 - Fixed bug #43293 (Multiple segfaults in getopt()). (Hannes)
 - Fixed bug #43279 (pg_send_query_params() converts all elements in 'params' 
   to strings). (Ilia)

diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index 640a2d1e5e25eb69dfe6718ddc8a109edb5954f4..1ad97175fbc8fc88bea9fc89adf6ed951a6601c2 100644 (file)
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -1074,9 +1074,9 @@ static void alloc_curl_handle(php_curl **ch)
                
        memset(&(*ch)->err, 0, sizeof((*ch)->err));
        
-       zend_llist_init(&(*ch)->to_free.str,   sizeof(char *),            (void(*)(void *)) curl_free_string, 0);
-       zend_llist_init(&(*ch)->to_free.slist, sizeof(struct curl_slist), (void(*)(void *)) curl_free_slist,  0);
-       zend_llist_init(&(*ch)->to_free.post,  sizeof(struct HttpPost),   (void(*)(void *)) curl_free_post,   0);
+       zend_llist_init(&(*ch)->to_free.str,   sizeof(char *),            (llist_dtor_func_t) curl_free_string, 0);
+       zend_llist_init(&(*ch)->to_free.slist, sizeof(struct curl_slist), (llist_dtor_func_t) curl_free_slist,  0);
+       zend_llist_init(&(*ch)->to_free.post,  sizeof(struct HttpPost),   (llist_dtor_func_t) curl_free_post,   0);
 }
 /* }}} */
 
@@ -1204,6 +1204,8 @@ PHP_FUNCTION(curl_copy_handle)
        curl_easy_setopt(dupch->cp, CURLOPT_WRITEHEADER,       (void *) dupch);
 
        zend_llist_copy(&dupch->to_free.str, &ch->to_free.str);
+       /* Don't try to free copied strings, they're free'd when the original handle is destroyed */
+       dupch->to_free.str.dtor = NULL;
        zend_llist_copy(&dupch->to_free.slist, &ch->to_free.slist);
        zend_llist_copy(&dupch->to_free.post, &ch->to_free.post);