MFH: Fixed bug #33987 (php script as ErrorDocument causes crash in Apache 2).

diff --git a/NEWS b/NEWS
index 5f1407e5d7b3c1303fcc6894853ff4a7f88ff680..01d711ab2673d540d3a7bdc9f1489e785258055c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -27,6 +27,8 @@ PHP                                                                        NEWS
 - Fixed bug #33996 (No information given for fatal error on passing invalid
   value to typed argument). (Dmitry)
 - Fixed bug #33989 (extract($GLOBALS,EXTR_REFS) crashes PHP). (Dmitry)
+- Fixed bug #33987 (php script as ErrorDocument causes crash in Apache 2).
+  (Ilia)
 - Fixed bug #33967 (misuse of Exception constructor doesn't display errorfile).
   (Jani)
 - Fixed bug #33958 (duplicate cookies and magic_quotes=off may cause a crash).

diff --git a/sapi/apache2handler/sapi_apache2.c b/sapi/apache2handler/sapi_apache2.c
index 11852789665215458a0d950efb94f00b11279628..c5734c0116d1adc9031a8fd2a9cab3e9c8662f2e 100644 (file)
--- a/sapi/apache2handler/sapi_apache2.c
+++ b/sapi/apache2handler/sapi_apache2.c
@@ -458,6 +458,7 @@ static int php_handler(request_rec *r)
        /* apply_config() needs r in some cases, so allocate server_context early */
        ctx = SG(server_context);
        if (ctx == NULL) {
+normal:
                ctx = SG(server_context) = apr_pcalloc(r->pool, sizeof(*ctx));
                /* register a cleanup so we clear out the SG(server_context)
                 * after each request. Note: We pass in the pointer to the
@@ -536,6 +537,11 @@ zend_first_try {
                }
        } else {
                parent_req = ctx->r;
+               /* check if comming due to ErrorDocument */
+               if (parent_req != HTTP_OK) {
+                       parent_req = NULL;
+                       goto normal;
+               }
                ctx->r = r;
                brigade = ctx->brigade;
        }