Fixed bug #60282 (Segfault when using ob_gzhandler() with open buffers)

diff --git a/NEWS b/NEWS
index 2c28d29f6e1a76277c40a2d5a22cb4cfec94e67b..a533db704412c08aa7673c601b91dd61d397fa0e 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,10 @@ PHP                                                                        NEWS
   . Fixed bug #59985 (show normal warning text for OCI_NO_DATA)
     (Chris Jones)
 
+- Output:
+  . Fixed bug #60282 (Segfault when using ob_gzhandler() with open buffers).
+    (Laruence)
+
 11 Nov 2011, PHP 5.4.0 RC1
 - General improvements:
   . Changed silent conversion of array to string to produce a notice. (Patrick)

diff --git a/main/output.c b/main/output.c
index 866ff1d0f575a606d27d1fc8e4400d648fd0ad3e..6a8f79a727413bfa283c4ffa4cdeea4aee2ebc0e 100644 (file)
--- a/main/output.c
+++ b/main/output.c
@@ -508,14 +508,14 @@ PHPAPI int php_output_handler_start(php_output_handler *handler TSRMLS_DC)
  * Check whether a certain output handler is in use */
 PHPAPI int php_output_handler_started(const char *name, size_t name_len TSRMLS_DC)
 {
-       php_output_handler **handlers;
+       php_output_handler ***handlers;
        int i, count = php_output_get_level(TSRMLS_C);
 
        if (count) {
-               handlers = *(php_output_handler ***) zend_stack_base(&OG(handlers));
+               handlers = (php_output_handler ***) zend_stack_base(&OG(handlers));
 
                for (i = 0; i < count; ++i) {
-                       if (name_len == handlers[i]->name_len && !memcmp(handlers[i]->name, name, name_len)) {
+                       if (name_len == (*(handlers[i]))->name_len && !memcmp((*(handlers[i]))->name, name, name_len)) {
                                return 1;
                        }
                }

diff --git a/tests/output/bug60282.phpt b/tests/output/bug60282.phpt
new file mode 100644 (file)
index 0000000..8719b66
--- /dev/null
+++ b/tests/output/bug60282.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #60282 (Segfault when using ob_gzhandler() with open buffers)
+--FILE--
+<?php
+ob_start();
+ob_start();
+ob_start('ob_gzhandler');
+echo "done";
+--EXPECT--
+done