- Fixed bug #61115 (stream related segfault on fatal error in

  php_stream_context_link).
#run-tests.php is not currently detecting the segfault in the test
#Missing 5.4 merge

diff --git a/ext/standard/tests/streams/bug61115.phpt b/ext/standard/tests/streams/bug61115.phpt
new file mode 100644 (file)
index 0000000..29dc7c1
--- /dev/null
+++ b/ext/standard/tests/streams/bug61115.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #61115: Stream related segfault on fatal error in php_stream_context_del_link.
+--FILE--
+<?php
+
+$arrayLarge = array_fill(0, 113663, '*');
+
+$resourceFileTemp = fopen('php://temp', 'r+');
+stream_context_set_params($resourceFileTemp, array());
+preg_replace('', function() {}, $resourceFileTemp);
+?>
+--EXPECTF--
+Catchable fatal error: Object of class Closure could not be converted to string in %s on line %d

diff --git a/main/streams/streams.c b/main/streams/streams.c
index dd614bbcc9f2ebadd6394bfcbf7cb263a150ef92..2ee60836470e027a5a7b36f991f4c0bbb64cf0ed 100755 (executable)
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -366,7 +366,9 @@ PHPAPI int _php_stream_free(php_stream *stream, int close_options TSRMLS_DC) /*
        int ret = 1;
        int preserve_handle = close_options & PHP_STREAM_FREE_PRESERVE_HANDLE ? 1 : 0;
        int release_cast = 1;
-       php_stream_context *context = stream->context;
+       /* on an unclean shutdown, the context may have already been freed (if it
+        * was created after the stream resource), so don't reference it */
+       php_stream_context *context = CG(unclean_shutdown) ? NULL : stream->context;
 
        if (stream->flags & PHP_STREAM_FLAG_NO_CLOSE) {
                preserve_handle = 1;