Fix memory corruption with libxml's error handling.

diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
index 84a15ac77293380a23e21a413296295131bc56ab..7545b69f3ff98920b613653d88c3de64642ab9e0 100644 (file)
--- a/ext/libxml/libxml.c
+++ b/ext/libxml/libxml.c
@@ -225,7 +225,7 @@ static void php_libxml_node_free_list(xmlNodePtr node TSRMLS_DC)
 static void php_libxml_init_globals(php_libxml_globals *libxml_globals_p TSRMLS_DC)
 {
        LIBXML(stream_context) = NULL;
-       LIBXML(error_buffer) = NULL;
+       LIBXML(error_buffer).c = NULL;
 }
 #endif
 
@@ -336,16 +336,15 @@ static void php_libxml_internal_error_handler(int error_type, void *ctx, const c
        if (output == 1) {
                switch (error_type) {
                        case PHP_LIBXML_CTX_ERROR:
-                               php_libxml_ctx_error_level(E_WARNING, ctx, (char *) LIBXML(error_buffer) TSRMLS_CC);
+                               php_libxml_ctx_error_level(E_WARNING, ctx, LIBXML(error_buffer).c TSRMLS_CC);
                                break;
                        case PHP_LIBXML_CTX_WARNING:
-                               php_libxml_ctx_error_level(E_NOTICE, ctx, (char *) LIBXML(error_buffer) TSRMLS_CC);
+                               php_libxml_ctx_error_level(E_NOTICE, ctx, LIBXML(error_buffer).c TSRMLS_CC);
                                break;
                        default:
-                               php_error(E_WARNING, "%s", (char *) LIBXML(error_buffer));
+                               php_error(E_WARNING, "%s", LIBXML(error_buffer).c);
                }
                smart_str_free(&LIBXML(error_buffer));
-               LIBXML(error_buffer) = NULL;
        }
 }
 
@@ -419,7 +418,7 @@ PHP_MINIT_FUNCTION(libxml)
        ts_allocate_id(&libxml_globals_id, sizeof(php_libxml_globals), (ts_allocate_ctor) php_libxml_init_globals, NULL);
 #else
        LIBXML(stream_context) = NULL;
-       LIBXML(error_buffer) = NULL;
+       LIBXML(error_buffer).c = NULL;
 #endif
 
        return SUCCESS;
@@ -441,10 +440,7 @@ PHP_MSHUTDOWN_FUNCTION(libxml)
 
 PHP_RSHUTDOWN_FUNCTION(libxml)
 {
-       if (LIBXML(error_buffer)) {
-               smart_str_free(&LIBXML(error_buffer));
-               LIBXML(error_buffer) = NULL;
-       }
+       smart_str_free(&LIBXML(error_buffer));
        return SUCCESS;
 }
 

diff --git a/ext/libxml/php_libxml.h b/ext/libxml/php_libxml.h
index 0cb5f0d620780ea7d3a41a83a97ab977b83b525c..d1c6b86903bebbf2e8e7ab71cdac3ee42db7442c 100644 (file)
--- a/ext/libxml/php_libxml.h
+++ b/ext/libxml/php_libxml.h
@@ -42,7 +42,7 @@ extern zend_module_entry libxml_module_entry;
 
 typedef struct {
        zval *stream_context;
-       smart_str *error_buffer;
+       smart_str error_buffer;
 } php_libxml_globals;
 
 typedef struct _php_libxml_ref_obj {