MFH: Fixed bug #25570 (Possible crash in apache2handler when zend_bailout

called outside of zend_try {} block).

diff --git a/NEWS b/NEWS
index 9d72ea272c72874f591a4e324b661a5b5b7d2326..32d54fec5a561f05087bd9108b5c5ac714c3992c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,8 @@ PHP 4                                                                      NEWS
 - Fixed crash bug when non-existing save/serializer handler was used. (Jani)
 - Fixed memory leak in gethostbynamel() if an error occurs. (Sara)
 - Fixed FastCGI being unable to bind to a specific IP. (Sascha)
+- Fixed bug #25570 (Possible crash in apache2handler when zend_bailout called
+  outside of zend_try {} block). (Ilia)
 - Fixed bug #25530 (checkdate() incorrectly handles floats). (Ilia)
 - Fixed bug #25525 (ldap_explode_dn() crashes when passed invalid dn).
   (Sara, patch by: mikael dot suvi at trigger dot ee)

diff --git a/sapi/apache2handler/sapi_apache2.c b/sapi/apache2handler/sapi_apache2.c
index 93cc3fdab50b28d0f1db0311e92d3b12ebc4d596..7e9b1e503979fefb4e370422faf339d7b36fcee3 100644 (file)
--- a/sapi/apache2handler/sapi_apache2.c
+++ b/sapi/apache2handler/sapi_apache2.c
@@ -492,6 +492,8 @@ static int php_handler(request_rec *r)
                ap_add_cgi_vars(r);
        }
 
+zend_first_try {
+
        ctx = SG(server_context);
        if (ctx == NULL) {
                ctx = SG(server_context) = apr_pcalloc(r->pool, sizeof(*ctx));
@@ -561,6 +563,8 @@ static int php_handler(request_rec *r)
                ctx->r = parent_req;
        }
 
+} zend_end_try();
+
        return OK;
 }