fix bugs #32742 (segmentation fault when the stream with a wrapper is not closed),

#32171 (Userspace stream wrapper crashes PHP)

diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index 41c9211369080eb82d8eb2c64fe641f7a8347cfb..bb806817659747917caebc8653a2c2e05d076275 100644 (file)
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -1219,18 +1219,11 @@ PHP_RSHUTDOWN_FUNCTION(basic)
        }
        STR_FREE(BG(locale_string));
 
-       if (FG(stream_wrappers)) {
-               zend_hash_destroy(FG(stream_wrappers));
-               efree(FG(stream_wrappers));
-               FG(stream_wrappers) = NULL;
-       }
-
-       if (FG(stream_filters)) {
-               zend_hash_destroy(FG(stream_filters));
-               efree(FG(stream_filters));
-               FG(stream_filters) = NULL;
-       }
-
+       /*
+        FG(stream_wrappers) and FG(stream_filters) are destroyed
+        during php_request_shutdown()
+        */
+       
        PHP_RSHUTDOWN(filestat)(SHUTDOWN_FUNC_ARGS_PASSTHRU);
 #ifdef HAVE_SYSLOG_H
        PHP_RSHUTDOWN(syslog)(SHUTDOWN_FUNC_ARGS_PASSTHRU);

diff --git a/main/main.c b/main/main.c
index 317295d6c491f8859b4420abec659f45467b1b32..cb687576d4b82b3266cfaea097339996c2ad6ecf 100644 (file)
--- a/main/main.c
+++ b/main/main.c
@@ -1159,6 +1159,10 @@ void php_request_shutdown_for_hook(void *dummy)
                sapi_deactivate(TSRMLS_C);
        } zend_end_try();
 
+       zend_try {
+               php_shutdown_stream_hashes(TSRMLS_C);
+       } zend_end_try();
+
        zend_try {
                shutdown_memory_manager(CG(unclean_shutdown), 0 TSRMLS_CC);
        } zend_end_try();
@@ -1234,12 +1238,17 @@ void php_request_shutdown(void *dummy)
                sapi_deactivate(TSRMLS_C);
        } zend_end_try();
 
-       /* 10. Free Willy (here be crashes) */
+       /* 10. Destroy stream hashes */
+       zend_try {
+               php_shutdown_stream_hashes(TSRMLS_C);
+       } zend_end_try();
+
+       /* 11. Free Willy (here be crashes) */
        zend_try {
                shutdown_memory_manager(CG(unclean_shutdown) || !report_memleaks, 0 TSRMLS_CC);
        } zend_end_try();
 
-       /* 11. Reset max_execution_time */
+       /* 12. Reset max_execution_time */
        zend_try { 
                zend_unset_timeout(TSRMLS_C);
        } zend_end_try();

diff --git a/main/php_streams.h b/main/php_streams.h
index 10fc248a00fdc336287afe491b1b283b13dfb2bc..0fc871b87f1b891d4ae916987c06af05ef9976c4 100755 (executable)
--- a/main/php_streams.h
+++ b/main/php_streams.h
@@ -502,6 +502,7 @@ END_EXTERN_C()
 
 int php_init_stream_wrappers(int module_number TSRMLS_DC);
 int php_shutdown_stream_wrappers(int module_number TSRMLS_DC);
+void php_shutdown_stream_hashes(TSRMLS_D);
 PHP_RSHUTDOWN_FUNCTION(streams);
 
 BEGIN_EXTERN_C()

diff --git a/main/streams/streams.c b/main/streams/streams.c
index 3729eaf74e3fd831f127e80c5ce33df7fe7bb58b..be19c80cc5bfca34567730fa608ec0eaca40f7ba 100755 (executable)
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -1378,6 +1378,21 @@ static void stream_resource_persistent_dtor(zend_rsrc_list_entry *rsrc TSRMLS_DC
        FG(pclose_ret) = php_stream_free(stream, PHP_STREAM_FREE_CLOSE | PHP_STREAM_FREE_RSRC_DTOR);
 }
 
+void php_shutdown_stream_hashes(TSRMLS_D)
+{
+       if (FG(stream_wrappers)) {
+               zend_hash_destroy(FG(stream_wrappers));
+               efree(FG(stream_wrappers));
+               FG(stream_wrappers) = NULL;
+       }
+
+       if (FG(stream_filters)) {
+               zend_hash_destroy(FG(stream_filters));
+               efree(FG(stream_filters));
+               FG(stream_filters) = NULL;
+       }
+}
+
 int php_init_stream_wrappers(int module_number TSRMLS_DC)
 {
        le_stream = zend_register_list_destructors_ex(stream_resource_regular_dtor, NULL, "stream", module_number);