Fix for bug #33690

diff --git a/NEWS b/NEWS
index 4733543647548392beb3609bedef256873a50a38..c568a8d9693ba422e4a69ef10d4de58482cfc88e 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2005, Version 4.4.1
+- Fixed bug #33690 (Crash setting some ini directives in httpd.conf). (Rasmus)
 - Fixed bug #33673 (Added detection for partially uploaded files). (Ilia)
 - Fixed bug #33648 (Using --with-regex=system causes compile failure). (Andrei)
 - Fixed bug #33156 (cygwin version of setitimer doesn't accept ITIMER_PROF).

diff --git a/sapi/apache2handler/sapi_apache2.c b/sapi/apache2handler/sapi_apache2.c
index 48c80d732a84940cdde95cbc9b134f9766d1b90c..809abdf46be7ae6450987272e73e9967ab15ae52 100644 (file)
--- a/sapi/apache2handler/sapi_apache2.c
+++ b/sapi/apache2handler/sapi_apache2.c
@@ -454,6 +454,21 @@ static int php_handler(request_rec *r)
        TSRMLS_FETCH();
 
        conf = ap_get_module_config(r->per_dir_config, &php4_module);
+
+       /* apply_config() needs r in some cases, so allocate server_context early */
+       ctx = SG(server_context);
+       if (ctx == NULL) {
+               ctx = SG(server_context) = apr_pcalloc(r->pool, sizeof(*ctx));
+               /* register a cleanup so we clear out the SG(server_context)
+                * after each request. Note: We pass in the pointer to the
+                * server_context in case this is handled by a different thread.
+                */
+               apr_pool_cleanup_register(r->pool, (void *)&SG(server_context), php_server_context_cleanup, apr_pool_cleanup_null);
+               ctx->r = r;
+               ctx = NULL; /* May look weird to null it here, but it is to catch the right case in the first_try later on */
+       } else {
+               ctx->r = r;
+       }
        apply_config(conf);
 
        if (strcmp(r->handler, PHP_MAGIC_TYPE) && strcmp(r->handler, PHP_SOURCE_MAGIC_TYPE) && strcmp(r->handler, PHP_SCRIPT)) {
@@ -511,17 +526,9 @@ static int php_handler(request_rec *r)
 
 zend_first_try {
 
-       ctx = SG(server_context);
        if (ctx == NULL) {
-               ctx = SG(server_context) = apr_pcalloc(r->pool, sizeof(*ctx));
-               /* register a cleanup so we clear out the SG(server_context)
-                * after each request. Note: We pass in the pointer to the
-                * server_context in case this is handled by a different thread.
-                */
-               apr_pool_cleanup_register(r->pool, (void *)&SG(server_context), php_server_context_cleanup, apr_pool_cleanup_null);
-
-               ctx->r = r;
                brigade = apr_brigade_create(r->pool, r->connection->bucket_alloc);
+               ctx = SG(server_context);
                ctx->brigade = brigade;
 
                if (php_apache_request_ctor(r, ctx TSRMLS_CC)!=SUCCESS) {