MFH: fix #41037 (unregister_tick_function() inside the tick function crash PHP)

diff --git a/NEWS b/NEWS
index 0be7180be80ed8ae3dbe61b762d0e53c46ad0536..617bc59158904e0cd762264e9fe35bc3c1116367 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -47,6 +47,8 @@ PHP                                                                        NEWS
 - Fixed zend_llist_remove_tail (Michael Wallner, Dmitry)
 - Fixed a thread safety issue in gd gif read code (Nuno, Roman Nemecek)
 - Fixed CVE-2007-1001, GD wbmp used with invalid image size (Pierre)
+- Fixed bug #41037 (unregister_tick_function() inside the tick function crash PHP).
+  (Tony)
 - Fixed bug #41026 (segfault when calling "self::method()" in shutdown functions).
   (Tony)
 - Fixed bug #40999 (mcrypt_create_iv() not using random seed). (Ilia)

diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index c420805e2703793ecfbb9dca28d9961635ce63d8..d6186e618ff6375b60495804ad098fe15c7bd3d6 100644 (file)
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -5317,17 +5317,24 @@ static int user_tick_function_compare(user_tick_function_entry * tick_fe1, user_
 {
        zval *func1 = tick_fe1->arguments[0];
        zval *func2 = tick_fe2->arguments[0];
+       int ret;
        TSRMLS_FETCH();
 
        if (Z_TYPE_P(func1) == IS_STRING && Z_TYPE_P(func2) == IS_STRING) {
-               return (zend_binary_zval_strcmp(func1, func2) == 0);
+               ret = (zend_binary_zval_strcmp(func1, func2) == 0);
        } else if (Z_TYPE_P(func1) == IS_ARRAY && Z_TYPE_P(func2) == IS_ARRAY) {
                zval result;
                zend_compare_arrays(&result, func1, func2 TSRMLS_CC);
-               return (Z_LVAL(result) == 0);
+               ret = (Z_LVAL(result) == 0);
        } else {
+               ret = 0;
+       }
+
+       if (ret && tick_fe1->calling) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to delete tick function executed at the moment");
                return 0;
        }
+       return ret;
 }
 
 void php_call_shutdown_functions(TSRMLS_D)

diff --git a/ext/standard/tests/general_functions/bug41037.phpt b/ext/standard/tests/general_functions/bug41037.phpt
new file mode 100644 (file)
index 0000000..eab2c33
--- /dev/null
+++ b/ext/standard/tests/general_functions/bug41037.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #41037 (unregister_tick_function() inside the tick function crash PHP)
+--FILE--
+<?php
+
+function a() {
+               echo "hello";
+                       unregister_tick_function('a');
+}
+
+declare (ticks=1);
+register_tick_function('a');
+
+echo "Done\n";
+?>
+--EXPECTF--    
+hello
+Warning: unregister_tick_function(): Unable to delete tick function executed at the moment in %s on line %d
+Done
+hello
+Warning: unregister_tick_function(): Unable to delete tick function executed at the moment in %s on line %d
+hello
+Warning: unregister_tick_function(): Unable to delete tick function executed at the moment in %s on line %d