- Fixed bug #61115 (stream related segfault on fatal error in

  php_stream_context_link).
#run-tests.php is not currently detecting the segfault in the test
#Missing 5.4 merge

diff --git a/NEWS b/NEWS
index e08776fa847c75dd7181fab11b14fe2d66893a21..a30382c5892f3d5f08fae414392e3799b49c2100 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -29,6 +29,8 @@ PHP                                                                        NEWS
   . Fixed bug #60802 (ibase_trans() gives segfault when passing params).
 
 - Streams:
+  . Fixed bug #61115 (stream related segfault on fatal error in
+    php_stream_context_link). (Gustavo)
   . Further fix for bug #60455 (stream_get_line misbehaves if EOF is not detected
     together with the last read). (Gustavo)
   . Fixed bug #60817 (stream_get_line() reads from stream even when there is

diff --git a/ext/standard/tests/streams/bug61115.phpt b/ext/standard/tests/streams/bug61115.phpt
new file mode 100644 (file)
index 0000000..29dc7c1
--- /dev/null
+++ b/ext/standard/tests/streams/bug61115.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #61115: Stream related segfault on fatal error in php_stream_context_del_link.
+--FILE--
+<?php
+
+$arrayLarge = array_fill(0, 113663, '*');
+
+$resourceFileTemp = fopen('php://temp', 'r+');
+stream_context_set_params($resourceFileTemp, array());
+preg_replace('', function() {}, $resourceFileTemp);
+?>
+--EXPECTF--
+Catchable fatal error: Object of class Closure could not be converted to string in %s on line %d

diff --git a/main/streams/streams.c b/main/streams/streams.c
index af9f49f451be7cb9604da7f9cd95b85156412a0f..39e29765186e8eef5b5c9e11698ec664c0c16fdd 100755 (executable)
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -320,7 +320,9 @@ PHPAPI int _php_stream_free(php_stream *stream, int close_options TSRMLS_DC) /*
        int remove_rsrc = 1;
        int preserve_handle = close_options & PHP_STREAM_FREE_PRESERVE_HANDLE ? 1 : 0;
        int release_cast = 1;
-       php_stream_context *context = stream->context;
+       /* on an unclean shutdown, the context may have already been freed (if it
+        * was created after the stream resource), so don't reference it */
+       php_stream_context *context = CG(unclean_shutdown) ? NULL : stream->context;
 
        if (stream->flags & PHP_STREAM_FLAG_NO_CLOSE) {
                preserve_handle = 1;
@@ -374,8 +376,8 @@ fprintf(stderr, "stream_free: %s:%p[%s] preserve_handle=%d release_cast=%d remov
        }
 
        /* Remove stream from any context link list */
-       if (stream->context && stream->context->links) {
-               php_stream_context_del_link(stream->context, stream);
+       if (context && context->links) {
+               php_stream_context_del_link(context, stream);
        }
 
        if (close_options & PHP_STREAM_FREE_CALL_DTOR) {