MFH: fix bug #48518 (curl crashes when writing into invalid file handle)

diff --git a/NEWS b/NEWS
index 6a808f94126527ec3224f0c073e65962cd664fa5..58800d5d6d3ac839fa31893108438ad82d5a05a0 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,7 @@
 - Updated timezone database to version 2009.9 (2009i) (Derick)
 - Added "ignore_errors" option to http fopen wrapper. (David Zulke, Sara)
 
+- Fixed bug #48518 (curl crashes when writing into invalid file handle). (Tony)
 - Fixed bug #48469 (ldap_get_entries() leaks memory on empty search results).
   (Patrick)
 - Fixed bug #48456 (CPPFLAGS not restored properly in phpize.m4).

diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index e04edb3936584f556416e3ae9538a1516880a2d7..4fcba360f67c877cb584986978174e45e2341a0e 100644 (file)
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -1437,6 +1437,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
                        switch (option) {
                                case CURLOPT_FILE:
                                        if (((php_stream *) what)->mode[0] != 'r') {
+                                               zend_list_addref(Z_LVAL_PP(zvalue));
                                                ch->handlers->write->fp = fp;
                                                ch->handlers->write->method = PHP_CURL_FILE;
                                        } else {
@@ -1447,6 +1448,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
                                        break;
                                case CURLOPT_WRITEHEADER:
                                        if (((php_stream *) what)->mode[0] != 'r') {
+                                               zend_list_addref(Z_LVAL_PP(zvalue));
                                                ch->handlers->write_header->fp = fp;
                                                ch->handlers->write_header->method = PHP_CURL_FILE;
                                        } else {