Fix a major thread safety bug in the output mechanism

@- Fixed a major memory corruption bug in the thread safe version (Zeev)

diff --git a/ext/standard/output.c b/ext/standard/output.c
index cacf045a0cc4596130222ce6c096639150a33243..c29ef419000a5aca42c8ec8cb87a0b23ea5f6a24 100644 (file)
--- a/ext/standard/output.c
+++ b/ext/standard/output.c
@@ -61,22 +61,24 @@ static void php_output_init_globals(OLS_D)
 
 
 /* Start output layer */
-PHPAPI void php_output_startup()
+PHPAPI void php_output_startup(void)
 {
 #ifdef ZTS
        output_globals_id = ts_allocate_id(sizeof(php_output_globals), (ts_allocate_ctor) php_output_init_globals, NULL);
 #else 
        php_output_init_globals(OLS_C);
 #endif
+}
 
-       {
-               OLS_FETCH();
 
-               OG(php_body_write) = php_ub_body_write;
-               OG(php_header_write) = sapi_module.ub_write;
-               OG(nesting_level) = 0;
-               OG(lock) = 0;
-       }
+PHPAPI void php_output_activate(void)
+{
+       OLS_FETCH();
+
+       OG(php_body_write) = php_ub_body_write;
+       OG(php_header_write) = sapi_module.ub_write;
+       OG(nesting_level) = 0;
+       OG(lock) = 0;
 }
 
 

diff --git a/ext/standard/php_output.h b/ext/standard/php_output.h
index 58a3db8c15d51160c141dd031597602518ed8e7b..2d06f5ce34cbf420f5d9311c58ade19cbe22502e 100644 (file)
--- a/ext/standard/php_output.h
+++ b/ext/standard/php_output.h
@@ -26,6 +26,7 @@
 typedef void (*php_output_handler_func_t)(char *output, uint output_len, char **handled_output, uint *handled_output_len, int mode);
 
 PHPAPI void php_output_startup(void);
+PHPAPI void php_output_activate(void);
 void php_output_register_constants(void);
 PHPAPI int  php_body_write(const char *str, uint str_length);
 PHPAPI int  php_header_write(const char *str, uint str_length);

diff --git a/main/main.c b/main/main.c
index 73d2bc9889399ce83d34349a3e449dd9b2754118..eecf8e1a9c80767dd06cff3a39105f3a6cb73a03 100644 (file)
--- a/main/main.c
+++ b/main/main.c
@@ -613,7 +613,7 @@ int php_request_startup(CLS_D ELS_DC PLS_DC SLS_DC)
 
        PG(during_request_startup) = 1;
        
-       php_output_startup();
+       php_output_activate();
 
        /* initialize global variables */
        PG(modules_activated) = 0;
@@ -829,6 +829,7 @@ int php_module_startup(sapi_module_struct *sf)
        sapi_module = *sf;
 
        php_output_startup();
+       php_output_activate();
 
        zuf.error_function = php_error_cb;
        zuf.printf_function = php_printf;

diff --git a/main/output.c b/main/output.c
index cacf045a0cc4596130222ce6c096639150a33243..c29ef419000a5aca42c8ec8cb87a0b23ea5f6a24 100644 (file)
--- a/main/output.c
+++ b/main/output.c
@@ -61,22 +61,24 @@ static void php_output_init_globals(OLS_D)
 
 
 /* Start output layer */
-PHPAPI void php_output_startup()
+PHPAPI void php_output_startup(void)
 {
 #ifdef ZTS
        output_globals_id = ts_allocate_id(sizeof(php_output_globals), (ts_allocate_ctor) php_output_init_globals, NULL);
 #else 
        php_output_init_globals(OLS_C);
 #endif
+}
 
-       {
-               OLS_FETCH();
 
-               OG(php_body_write) = php_ub_body_write;
-               OG(php_header_write) = sapi_module.ub_write;
-               OG(nesting_level) = 0;
-               OG(lock) = 0;
-       }
+PHPAPI void php_output_activate(void)
+{
+       OLS_FETCH();
+
+       OG(php_body_write) = php_ub_body_write;
+       OG(php_header_write) = sapi_module.ub_write;
+       OG(nesting_level) = 0;
+       OG(lock) = 0;
 }
 
 

diff --git a/main/php_output.h b/main/php_output.h
index 58a3db8c15d51160c141dd031597602518ed8e7b..2d06f5ce34cbf420f5d9311c58ade19cbe22502e 100644 (file)
--- a/main/php_output.h
+++ b/main/php_output.h
@@ -26,6 +26,7 @@
 typedef void (*php_output_handler_func_t)(char *output, uint output_len, char **handled_output, uint *handled_output_len, int mode);
 
 PHPAPI void php_output_startup(void);
+PHPAPI void php_output_activate(void);
 void php_output_register_constants(void);
 PHPAPI int  php_body_write(const char *str, uint str_length);
 PHPAPI int  php_header_write(const char *str, uint str_length);

diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c
index bd1ae858732b76a6f602748fb569496bc4cbd939..151d33a979eb00306378f16f594a92c7f865305d 100644 (file)
--- a/sapi/cgi/cgi_main.c
+++ b/sapi/cgi/cgi_main.c
@@ -502,6 +502,7 @@ any .htaccess restrictions anywhere on your site you can leave doc_root undefine
                                case '?':
                                        no_headers = 1;
                                        php_output_startup();
+                                       php_output_activate();
                                        SG(headers_sent) = 1;
                                        php_cgi_usage(argv[0]);
                                        php_end_ob_buffers(1);
@@ -566,6 +567,7 @@ any .htaccess restrictions anywhere on your site you can leave doc_root undefine
                                case '?':
                                        no_headers = 1;  
                                        php_output_startup();
+                                       php_output_activate();
                                        SG(headers_sent) = 1;
                                        php_cgi_usage(argv[0]);
                                        php_end_ob_buffers(1);
@@ -592,6 +594,7 @@ any .htaccess restrictions anywhere on your site you can leave doc_root undefine
 
                        case 'm': /* list compiled in modules */
                        php_output_startup();
+                               php_output_activate();
                 SG(headers_sent) = 1;
                                php_printf("Running PHP %s\n%s\n", PHP_VERSION , get_zend_version());
                                php_printf("[PHP Modules]\n");