MFH:- Fixed bug #48203 (Crash when CURLOPT_STDERR is set to regular file)

diff --git a/NEWS b/NEWS
index 5a1a9acfa1dc1ce7453008a024b7401ec1c044fd..f2bc25ad36f7e4a97d6af96c0bcd5bb911b464c8 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -37,6 +37,7 @@ PHP                                                                        NEWS
   with RecursiveIteratorIterator leads to a segfault). (Scott)
 - Fixed bug #48204 (xmlwriter_open_uri() does not emit warnings on invalid
   paths). (Ilia)
+- Fixed bug #48203 (Crash when CURLOPT_STDERR is set to regular file). (Jani)
 - Fixed bug #48202 (Out of Memory error message when passing invalid file path)
   (Pierre)
 - Fixed bug #48156 (Added support for lcov v1.7). (Ilia)

diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index ffea78e7a65a2bc809e1cc856f0df30fe9fd4d1a..be3781f1cac804b9c7e728246a5dcf9f9173133f 100644 (file)
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -370,7 +370,7 @@ PHP_MINIT_FUNCTION(curl)
        le_curl_multi_handle = zend_register_list_destructors_ex(_php_curl_multi_close, NULL, "curl", module_number);
 
        /* See http://curl.haxx.se/lxr/source/docs/libcurl/symbols-in-versions
-          or curl src/docs/libcurl/symbols-in-versions for a (almost) complete list 
+          or curl src/docs/libcurl/symbols-in-versions for a (almost) complete list
           of options and which version they were introduced */
 
        /* Constants for curl_setopt() */
@@ -1460,6 +1460,20 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
                                        ch->handlers->read->fp = fp;
                                        ch->handlers->read->fd = Z_LVAL_PP(zvalue);
                                        break;
+                               case CURLOPT_STDERR:
+                                       if (((php_stream *) what)->mode[0] != 'r') {
+                                               if (ch->handlers->stderr) {
+                                                       zval_ptr_dtor(&ch->handlers->stderr);
+                                               }
+                                               zval_add_ref(zvalue);
+                                               ch->handlers->stderr = *zvalue;
+                                               zend_list_addref(Z_LVAL_PP(zvalue));
+                                       } else {
+                                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "the provided file handle is not writable");
+                                               RETVAL_FALSE;
+                                               return 1;
+                                       }
+                                       /* break omitted intentionally */
                                default:
                                        error = curl_easy_setopt(ch->cp, option, fp);
                                        break;
@@ -2046,6 +2060,11 @@ static void _php_curl_close_ex(php_curl *ch TSRMLS_DC)
        fprintf(stderr, "DTOR CALLED, ch = %x\n", ch);
 #endif
 
+       /* Prevent crash inside cURL if passed file has already been closed */
+       if (ch->handlers->stderr && Z_REFCOUNT_P(ch->handlers->stderr) <= 0) {
+               curl_easy_setopt(ch->cp, CURLOPT_STDERR, stderr);
+       }
+
        curl_easy_cleanup(ch->cp);
 #if LIBCURL_VERSION_NUM < 0x071101
        zend_llist_clean(&ch->to_free.str);
@@ -2068,6 +2087,9 @@ static void _php_curl_close_ex(php_curl *ch TSRMLS_DC)
        if (ch->handlers->passwd) {
                zval_ptr_dtor(&ch->handlers->passwd);
        }
+       if (ch->handlers->stderr) {
+               zval_ptr_dtor(&ch->handlers->stderr);
+       }
        if (ch->header.str_len > 0) {
                efree(ch->header.str);
        }

diff --git a/ext/curl/php_curl.h b/ext/curl/php_curl.h
index 6f2931a7bc6f8a756980eabfe6710e9110ddbd47..071e69c6fe0747906829c43a1ce77ff03b2ee5f8 100644 (file)
--- a/ext/curl/php_curl.h
+++ b/ext/curl/php_curl.h
@@ -101,6 +101,7 @@ typedef struct {
        php_curl_write *write_header;
        php_curl_read  *read;
        zval           *passwd;
+       zval           *stderr;
 } php_curl_handlers;
 
 struct _php_curl_error  {