MFH: Fixed bug #30475 (curl_getinfo() may crash in some situations).

diff --git a/NEWS b/NEWS
index 83cf0266f7d68cfebe031b3b89144354352ef2ab..ecf09a8b70e83ada4d7f3f4ef9d36984df450404 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,7 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2004, PHP 5.0.3
 - Fixed potential problems with unserializing invalid serialize data. (Marcus)
+- Fixed bug #30475 (curl_getinfo() may crash in some situations). (Ilia)
 - Fixed bug #30442 (segfault when parsing ?getvariable[][ ). (Tony)
 - Fixed bug #30387 (stream_socket_client async connect was broken).
   (vnegrier at esds dot com, Wez).

diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index 46021ef4b94cca90e5f242ac6be3082ca2119e4e..07fc6346385f6decad70b1b42ab461180b7f9157 100644 (file)
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -431,6 +431,7 @@ static size_t curl_write(char *data, size_t size, size_t nmemb, void *ctx)
                        PHPWRITE(data, length);
                        break;
                case PHP_CURL_FILE:
+                       fflush(t->fp);
                        return fwrite(data, size, nmemb, t->fp);
                case PHP_CURL_RETURN:
                        smart_str_appendl(&t->buf, data, (int) length);
@@ -1336,10 +1337,13 @@ PHP_FUNCTION(curl_getinfo)
                switch (option) {
                        case CURLINFO_EFFECTIVE_URL: 
                        case CURLINFO_CONTENT_TYPE: {
-                               char *s_code;
+                               char *s_code = NULL;
 
-                               curl_easy_getinfo(ch->cp, option, &s_code);
-                               RETURN_STRING(s_code, 1);
+                               if (curl_easy_getinfo(ch->cp, option, &s_code) == CURLE_OK && s_code) {
+                                       RETURN_STRING(s_code, 1);
+                               } else {
+                                       RETURN_FALSE;
+                               }
                                break;
                        }
                        case CURLINFO_HTTP_CODE: 
@@ -1348,10 +1352,13 @@ PHP_FUNCTION(curl_getinfo)
                        case CURLINFO_FILETIME: 
                        case CURLINFO_SSL_VERIFYRESULT: 
                        case CURLINFO_REDIRECT_COUNT: {
-                               long code;
+                               long code = 0;
 
-                               curl_easy_getinfo(ch->cp, option, &code);
-                               RETURN_LONG(code);
+                               if (curl_easy_getinfo(ch->cp, option, &code) == CURLE_OK) {
+                                       RETURN_LONG(code);
+                               } else {
+                                       RETURN_FALSE;
+                               }
                                break;
                        }
                        case CURLINFO_TOTAL_TIME: 
@@ -1366,10 +1373,13 @@ PHP_FUNCTION(curl_getinfo)
                        case CURLINFO_CONTENT_LENGTH_UPLOAD: 
                        case CURLINFO_STARTTRANSFER_TIME:
                        case CURLINFO_REDIRECT_TIME: {
-                               double code;
+                               double code = 0.0;
 
-                               curl_easy_getinfo(ch->cp, option, &code);
-                               RETURN_DOUBLE(code);
+                               if (curl_easy_getinfo(ch->cp, option, &code) == CURLE_OK) {
+                                       RETURN_DOUBLE(code);
+                               } else {
+                                       RETURN_FALSE;
+                               }
                                break;
                        }
                }