fix #40635 (segfault in cURL extension)

diff --git a/NEWS b/NEWS
index 6a72813172e0a92976534186c0bc299e491eefa3..97ab874f6d3d84ecc851d4cda5134db8af5add34 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,7 @@ PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Feb 2007, Version 4.4.6
 
+- Fixed bug #40635 (segfault in cURL extension). (Tony)
 - Fixed bug #40611 (possible cURL memory error). (Tony)
 
 22 Feb 2007, Version 4.4.6RC1

diff --git a/ext/curl/curl.c b/ext/curl/curl.c
index f1fe9f502f91a780376cc64c5eb39e52c3850e7c..c47c5609423abf16b705b33ab5de516e668cb767 100644 (file)
--- a/ext/curl/curl.c
+++ b/ext/curl/curl.c
@@ -1266,8 +1266,9 @@ cleanup_handle(php_curl *ch)
                return;
        }
 
-       if (ch->handlers->write->buf.len) {
-               memset(&ch->handlers->write->buf, 0, sizeof(smart_str));
+       if (ch->handlers->write->buf.len > 0) {
+               smart_str_free(&ch->handlers->write->buf);
+               ch->handlers->write->buf.len = 0;
        }
 
        memset(ch->err.str, 0, CURL_ERROR_SIZE + 1);
@@ -1297,6 +1298,7 @@ PHP_FUNCTION(curl_exec)
        if (error != CURLE_OK && error != CURLE_PARTIAL_FILE) {
                if (ch->handlers->write->buf.len > 0) {
                        smart_str_free(&ch->handlers->write->buf);
+                       ch->handlers->write->buf.len = 0;
                }
 
                RETURN_FALSE;
@@ -1306,9 +1308,10 @@ PHP_FUNCTION(curl_exec)
 
        if (ch->handlers->write->method == PHP_CURL_RETURN && ch->handlers->write->buf.len > 0) {
                --ch->uses;
-               if (ch->handlers->write->type != PHP_CURL_BINARY) 
+               if (ch->handlers->write->type != PHP_CURL_BINARY) { 
                        smart_str_0(&ch->handlers->write->buf);
-               RETURN_STRINGL(ch->handlers->write->buf.c, ch->handlers->write->buf.len, 0);
+               }
+               RETURN_STRINGL(ch->handlers->write->buf.c, ch->handlers->write->buf.len, 1);
        }
        --ch->uses;
        if (ch->handlers->write->method == PHP_CURL_RETURN) {
@@ -1533,6 +1536,10 @@ static void _php_curl_close(zend_rsrc_list_entry *rsrc TSRMLS_DC)
        zend_llist_clean(&ch->to_free.slist);
        zend_llist_clean(&ch->to_free.post);
 
+       if (ch->handlers->write->buf.len > 0) {
+               smart_str_free(&ch->handlers->write->buf);
+               ch->handlers->write->buf.len = 0;
+       }
        if (ch->handlers->write->func) {
                FREE_ZVAL(ch->handlers->write->func);
                ch->handlers->read->func = NULL;