Fix bugs #29583 and #31636

diff --git a/NEWS b/NEWS
index 50fb46b834daefc4f63751ab0449e6aed887c47f..e6ec8b6504806c0524cd367e4e530b4965aa4aef 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -27,11 +27,13 @@ PHP                                                                        NEWS
 - Fixed bug #32282 (Segfault in mysqli_fetch_array on 64-bit) (Georg).
 - Fixed bug #31887 (ISAPI: Custom 5xx error does not return correct HTTP 
   response message). (Jani)
+- Fixed bug #31636 (another crash when echoing a COM object). (Wez)
 - Fixed bug #31502 (Wrong deserialization from session when using WDDX
   serializer). (Dmitry) 
 - Fixed bug #31363 (broken non-blocking flock()). ian at snork dot net
 - Fixed bug #30833 (array_count_values() modifying input array). (Tony)
 - Fixed bug #30819 (Better support for LDAP SASL bind). (Jani)
+- Fixed bug #29583 (crash when echoing a COM object). (M.Sisolak, Wez)
 - Fixed bug #28839 (SIGSEGV in interactive mode (php -a)).
   (kameshj at fastmail dot fm)
 

diff --git a/ext/com_dotnet/com_handlers.c b/ext/com_dotnet/com_handlers.c
index cee0b41017598466f28be8fca638bfc50ab682b2..531c20273376a7b8378aa84f938aca87ef669485 100644 (file)
--- a/ext/com_dotnet/com_handlers.c
+++ b/ext/com_dotnet/com_handlers.c
@@ -524,14 +524,15 @@ static int com_object_cast(zval *readobj, zval *writeobj, int type, int should_f
        php_com_dotnet_object *obj;
        VARIANT v;
        VARTYPE vt = VT_EMPTY;
+       zval free_obj;
+       HRESULT res = S_OK;
 
        if (should_free) {
-               zval_dtor(writeobj);
+               free_obj = *writeobj;
        }
 
-       ZVAL_NULL(writeobj);
-
        obj = CDNO_FETCH(readobj);
+       ZVAL_NULL(writeobj);
        VariantInit(&v);
 
        if (V_VT(&obj->v) == VT_DISPATCH) {
@@ -564,12 +565,23 @@ static int com_object_cast(zval *readobj, zval *writeobj, int type, int should_f
        }
 
        if (vt != VT_EMPTY) {
-               VariantChangeType(&v, &v, 0, vt);
+               res = VariantChangeType(&v, &v, 0, vt);
+       }
+
+       if (SUCCEEDED(res)) {
+               php_com_zval_from_variant(writeobj, &v, obj->code_page TSRMLS_CC);
        }
 
-       php_com_zval_from_variant(writeobj, &v, obj->code_page TSRMLS_CC);
        VariantClear(&v);
-       return SUCCESS;
+       if (should_free) {
+               zval_dtor(&free_obj);
+       }
+
+       if (SUCCEEDED(res)) {
+               return SUCCESS;
+       }
+
+       return FAILURE;
 }
 
 static int com_object_count(zval *object, long *count TSRMLS_DC)