From: Greg Beaver <cellog@php.net>
Date: Mon, 9 Feb 2009 03:44:59 +0000 (+0000)
Subject: MFB fix Bug #46026 (this is a refinement of the previous fix)
X-Git-Tag: php-5.2.9RC2~20
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=300f28b58e6fff16738a44a6fdb70765611a0554;p=php

MFB fix Bug #46026 (this is a refinement of the previous fix)
---

diff --git a/NEWS b/NEWS
index f86efb924e..edd684a5f9 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,8 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Feb 2009, PHP 5.2.9
 - Fixed bug #47322 (sscanf %d doesn't work). (Felipe)
+- Fixed bug #46026 (bz2.decompress/zlib.inflate filter tries to decompress after
+  end of stream). (Greg)
 
 02 Feb 2009, PHP 5.2.9RC1
 - Changed __call() to be invoked on private/protected method access, similar to
diff --git a/ext/bz2/bz2_filter.c b/ext/bz2/bz2_filter.c
index 446e44c01a..4f10cc932d 100644
--- a/ext/bz2/bz2_filter.c
+++ b/ext/bz2/bz2_filter.c
@@ -332,10 +332,13 @@ static php_stream_filter *php_bz2_filter_create(const char *filtername, zval *fi
 			}
 
 			if (tmpzval) {
-				SEPARATE_ZVAL(tmpzval);
-				convert_to_boolean_ex(tmpzval);
-				smallFootprint = Z_LVAL_PP(tmpzval);
-				zval_ptr_dtor(tmpzval);
+				zval tmp, *tmp2;
+
+				tmp = **tmpzval;
+				zval_copy_ctor(&tmp);
+				tmp2 = &tmp;
+				convert_to_boolean_ex(&tmp2);
+				smallFootprint = Z_LVAL(tmp);
 			}
 		}
 
@@ -352,26 +355,31 @@ static php_stream_filter *php_bz2_filter_create(const char *filtername, zval *fi
 			if (Z_TYPE_P(filterparams) == IS_ARRAY || Z_TYPE_P(filterparams) == IS_OBJECT) {
 				if (zend_hash_find(HASH_OF(filterparams), "blocks", sizeof("blocks"), (void**) &tmpzval) == SUCCESS) {
 					/* How much memory to allocate (1 - 9) x 100kb */
-					SEPARATE_ZVAL(tmpzval);
-					convert_to_long_ex(tmpzval);
-					if (Z_LVAL_PP(tmpzval) < 1 || Z_LVAL_PP(tmpzval) > 9) {
+					zval tmp;
+	
+					tmp = **tmpzval;
+					zval_copy_ctor(&tmp);
+					convert_to_long(&tmp);
+					if (Z_LVAL(tmp) < 1 || Z_LVAL(tmp) > 9) {
 						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid parameter given for number of blocks to allocate. (%ld)", Z_LVAL_PP(tmpzval));
 					} else {
-						blockSize100k = Z_LVAL_PP(tmpzval);
+						blockSize100k = Z_LVAL(tmp);
 					}
-					zval_ptr_dtor(tmpzval);
 				}
 
 				if (zend_hash_find(HASH_OF(filterparams), "work", sizeof("work"), (void**) &tmpzval) == SUCCESS) {
 					/* Work Factor (0 - 250) */
-					SEPARATE_ZVAL(tmpzval);
-					convert_to_long_ex(tmpzval);
-					if (Z_LVAL_PP(tmpzval) < 0 || Z_LVAL_PP(tmpzval) > 250) {
-						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid parameter given for work factor. (%ld)", Z_LVAL_PP(tmpzval));
+					zval tmp;
+	
+					tmp = **tmpzval;
+					zval_copy_ctor(&tmp);
+					convert_to_long(&tmp);
+
+					if (Z_LVAL(tmp) < 0 || Z_LVAL(tmp) > 250) {
+						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid parameter given for work factor. (%ld)", Z_LVAL(tmp));
 					} else {
-						workFactor = Z_LVAL_PP(tmpzval);
+						workFactor = Z_LVAL(tmp);
 					}
-					zval_ptr_dtor(tmpzval);
 				}
 			}
 		}