MFH

Fixed bug #27183 (Userland stream wrapper segfaults on stream_write).

diff --git a/NEWS b/NEWS
index 0e109fd282a65e28c4dd379af900008f72a33dd7..ee05006d15ca2ca911d8beaf4a0919d7b2b497fb 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -22,6 +22,8 @@ PHP                                                                        NEWS
   characters). (Moriyoshi)
 - Fixed bug #27798 (private / protected variables not exposed by 
   get_object_vars() inside class). (Marcus)
+- Fixed bug #27183 (Userland stream wrapper segfaults on stream_write). 
+  (Christian)
 
 23 Sep 2004, PHP 5.0.2
 - Added new boolean (fourth) parameter to array_slice() that turns on the

diff --git a/main/streams/userspace.c b/main/streams/userspace.c
index 7bf7801d2f5ab61fad3a99101bc0135749efb479..bd21687ea0f7475f52f23ced1882484035756742 100644 (file)
--- a/main/streams/userspace.c
+++ b/main/streams/userspace.c
@@ -445,15 +445,15 @@ static size_t php_userstreamop_write(php_stream *stream, const char *buf, size_t
        int call_result;
        php_userstream_data_t *us = (php_userstream_data_t *)stream->abstract;
        zval **args[1];
-       zval zbuff, *zbufptr;
+       zval *zbufptr;
        size_t didwrite = 0;
 
        assert(us != NULL);
 
        ZVAL_STRINGL(&func_name, USERSTREAM_WRITE, sizeof(USERSTREAM_WRITE)-1, 0);
 
-       ZVAL_STRINGL(&zbuff, (char*)buf, count, 0);
-       zbufptr = &zbuff;
+       MAKE_STD_ZVAL(zbufptr);
+       ZVAL_STRINGL(zbufptr, (char*)buf, count, 1);;
        args[0] = &zbufptr;
 
        call_result = call_user_function_ex(NULL,
@@ -463,6 +463,8 @@ static size_t php_userstreamop_write(php_stream *stream, const char *buf, size_t
                        1, args,
                        0, NULL TSRMLS_CC);
 
+       zval_ptr_dtor(&zbufptr);
+
        didwrite = 0;
        if (call_result == SUCCESS && retval != NULL) {
                convert_to_long(retval);