From: Antony Dovgal <tony2001@php.net>
Date: Tue, 10 Apr 2007 09:37:09 +0000 (+0000)
Subject: MFH: fix #41037 (unregister_tick_function() inside the tick function crash PHP)
X-Git-Tag: php-5.2.2RC1~12
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=562f886ecb14b7d1095a0b555b96db4b22a9c000;p=php

MFH: fix #41037 (unregister_tick_function() inside the tick function crash PHP)
---

diff --git a/NEWS b/NEWS
index 0be7180be8..617bc59158 100644
--- a/NEWS
+++ b/NEWS
@@ -47,6 +47,8 @@ PHP                                                                        NEWS
 - Fixed zend_llist_remove_tail (Michael Wallner, Dmitry)
 - Fixed a thread safety issue in gd gif read code (Nuno, Roman Nemecek)
 - Fixed CVE-2007-1001, GD wbmp used with invalid image size (Pierre)
+- Fixed bug #41037 (unregister_tick_function() inside the tick function crash PHP).
+  (Tony)
 - Fixed bug #41026 (segfault when calling "self::method()" in shutdown functions).
   (Tony)
 - Fixed bug #40999 (mcrypt_create_iv() not using random seed). (Ilia)
diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index c420805e27..d6186e618f 100644
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -5317,17 +5317,24 @@ static int user_tick_function_compare(user_tick_function_entry * tick_fe1, user_
 {
 	zval *func1 = tick_fe1->arguments[0];
 	zval *func2 = tick_fe2->arguments[0];
+	int ret;
 	TSRMLS_FETCH();
 
 	if (Z_TYPE_P(func1) == IS_STRING && Z_TYPE_P(func2) == IS_STRING) {
-		return (zend_binary_zval_strcmp(func1, func2) == 0);
+		ret = (zend_binary_zval_strcmp(func1, func2) == 0);
 	} else if (Z_TYPE_P(func1) == IS_ARRAY && Z_TYPE_P(func2) == IS_ARRAY) {
 		zval result;
 		zend_compare_arrays(&result, func1, func2 TSRMLS_CC);
-		return (Z_LVAL(result) == 0);
+		ret = (Z_LVAL(result) == 0);
 	} else {
+		ret = 0;
+	}
+
+	if (ret && tick_fe1->calling) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to delete tick function executed at the moment");
 		return 0;
 	}
+	return ret;
 }
 
 void php_call_shutdown_functions(TSRMLS_D)
diff --git a/ext/standard/tests/general_functions/bug41037.phpt b/ext/standard/tests/general_functions/bug41037.phpt
new file mode 100644
index 0000000000..eab2c334c9
--- /dev/null
+++ b/ext/standard/tests/general_functions/bug41037.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #41037 (unregister_tick_function() inside the tick function crash PHP)
+--FILE--
+<?php
+
+function a() {
+		echo "hello";
+			unregister_tick_function('a');
+}
+
+declare (ticks=1);
+register_tick_function('a');
+
+echo "Done\n";
+?>
+--EXPECTF--	
+hello
+Warning: unregister_tick_function(): Unable to delete tick function executed at the moment in %s on line %d
+Done
+hello
+Warning: unregister_tick_function(): Unable to delete tick function executed at the moment in %s on line %d
+hello
+Warning: unregister_tick_function(): Unable to delete tick function executed at the moment in %s on line %d