MFB fix for bug #33690

diff --git a/NEWS b/NEWS
index b8ddd15e295d2342a0de114977ed902dde58ad33..6f56f8c1a0ce20192d580866072789431f3aad43 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2005, PHP 5.1
+- Fixed bug #33690 (Crash setting some ini directives in httpd.conf). (Rasmus)
 - Fixed bug #33841 (pdo sqlite driver forgets to update affected column count
   on execution of prepared statments).
 - Fixed bug #33802 (throw Exception in error handler causes crash). (Dmitry)

diff --git a/sapi/apache2handler/sapi_apache2.c b/sapi/apache2handler/sapi_apache2.c
index 72b181371b17c4f5c8a45765ca2cbccac52022eb..ba50b67ac35c311b6bf3539a05c5cc7fb3eab9ee 100644 (file)
--- a/sapi/apache2handler/sapi_apache2.c
+++ b/sapi/apache2handler/sapi_apache2.c
@@ -454,6 +454,21 @@ static int php_handler(request_rec *r)
        TSRMLS_FETCH();
 
        conf = ap_get_module_config(r->per_dir_config, &php5_module);
+
+       /* apply_config() needs r in some cases, so allocate server_context early */
+       ctx = SG(server_context);
+       if (ctx == NULL) {
+               ctx = SG(server_context) = apr_pcalloc(r->pool, sizeof(*ctx));
+               /* register a cleanup so we clear out the SG(server_context)
+                * after each request. Note: We pass in the pointer to the
+                * server_context in case this is handled by a different thread.
+                */
+               apr_pool_cleanup_register(r->pool, (void *)&SG(server_context), php_server_context_cleanup, apr_pool_cleanup_null);
+               ctx->r = r;
+               ctx = NULL; /* May look weird to null it here, but it is to catch the right case in the first_try later on */
+       } else {
+               ctx->r = r;
+       }
        apply_config(conf);
 
        if (strcmp(r->handler, PHP_MAGIC_TYPE) && strcmp(r->handler, PHP_SOURCE_MAGIC_TYPE) && strcmp(r->handler, PHP_SCRIPT)) {
@@ -511,17 +526,9 @@ static int php_handler(request_rec *r)
 
 zend_first_try {
 
-       ctx = SG(server_context);
        if (ctx == NULL) {
-               ctx = SG(server_context) = apr_pcalloc(r->pool, sizeof(*ctx));
-               /* register a cleanup so we clear out the SG(server_context)
-                * after each request. Note: We pass in the pointer to the
-                * server_context in case this is handled by a different thread.
-                */
-               apr_pool_cleanup_register(r->pool, (void *)&SG(server_context), php_server_context_cleanup, apr_pool_cleanup_null);
-
-               ctx->r = r;
                brigade = apr_brigade_create(r->pool, r->connection->bucket_alloc);
+               ctx = SG(server_context);
                ctx->brigade = brigade;
 
                if (php_apache_request_ctor(r, ctx TSRMLS_CC)!=SUCCESS) {