fix bug #48518 (curl crashes when writing into invalid file handle)

diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index 929259ea8c011ed5c44b5153be24d860a5e35260..74e092ebea203d6cfcba78186fac81836b4d8414 100644 (file)
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -1666,6 +1666,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
                        switch (option) {
                                case CURLOPT_FILE:
                                        if (((php_stream *) what)->mode[0] != 'r') {
+                                               zend_list_addref(Z_LVAL_PP(zvalue));
                                                ch->handlers->write->fp = fp;
                                                ch->handlers->write->method = PHP_CURL_FILE;
                                        } else {
@@ -1676,6 +1677,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
                                        break;
                                case CURLOPT_WRITEHEADER:
                                        if (((php_stream *) what)->mode[0] != 'r') {
+                                               zend_list_addref(Z_LVAL_PP(zvalue));
                                                ch->handlers->write_header->fp = fp;
                                                ch->handlers->write_header->method = PHP_CURL_FILE;
                                        } else {