From: Jani Taskinen <jani@php.net>
Date: Tue, 26 May 2009 15:50:44 +0000 (+0000)
Subject: MFH:- Fixed bug #48203 (Crash when CURLOPT_STDERR is set to regular file)
X-Git-Tag: php-5.2.10RC1~4
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=572cd2000b1780adb83a64d3279d61bc341ad7f9;p=php

MFH:- Fixed bug #48203 (Crash when CURLOPT_STDERR is set to regular file)
---

diff --git a/NEWS b/NEWS
index 5a1a9acfa1..f2bc25ad36 100644
--- a/NEWS
+++ b/NEWS
@@ -37,6 +37,7 @@ PHP                                                                        NEWS
   with RecursiveIteratorIterator leads to a segfault). (Scott)
 - Fixed bug #48204 (xmlwriter_open_uri() does not emit warnings on invalid
   paths). (Ilia)
+- Fixed bug #48203 (Crash when CURLOPT_STDERR is set to regular file). (Jani)
 - Fixed bug #48202 (Out of Memory error message when passing invalid file path)
   (Pierre)
 - Fixed bug #48156 (Added support for lcov v1.7). (Ilia)
diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index ffea78e7a6..be3781f1ca 100644
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -370,7 +370,7 @@ PHP_MINIT_FUNCTION(curl)
 	le_curl_multi_handle = zend_register_list_destructors_ex(_php_curl_multi_close, NULL, "curl", module_number);
 
 	/* See http://curl.haxx.se/lxr/source/docs/libcurl/symbols-in-versions
-	   or curl src/docs/libcurl/symbols-in-versions for a (almost) complete list 
+	   or curl src/docs/libcurl/symbols-in-versions for a (almost) complete list
 	   of options and which version they were introduced */
 
 	/* Constants for curl_setopt() */
@@ -1460,6 +1460,20 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
 					ch->handlers->read->fp = fp;
 					ch->handlers->read->fd = Z_LVAL_PP(zvalue);
 					break;
+				case CURLOPT_STDERR:
+					if (((php_stream *) what)->mode[0] != 'r') {
+						if (ch->handlers->stderr) {
+							zval_ptr_dtor(&ch->handlers->stderr);
+						}
+						zval_add_ref(zvalue);
+						ch->handlers->stderr = *zvalue;
+						zend_list_addref(Z_LVAL_PP(zvalue));
+					} else {
+						php_error_docref(NULL TSRMLS_CC, E_WARNING, "the provided file handle is not writable");
+						RETVAL_FALSE;
+						return 1;
+					}
+					/* break omitted intentionally */
 				default:
 					error = curl_easy_setopt(ch->cp, option, fp);
 					break;
@@ -2046,6 +2060,11 @@ static void _php_curl_close_ex(php_curl *ch TSRMLS_DC)
 	fprintf(stderr, "DTOR CALLED, ch = %x\n", ch);
 #endif
 
+	/* Prevent crash inside cURL if passed file has already been closed */
+	if (ch->handlers->stderr && Z_REFCOUNT_P(ch->handlers->stderr) <= 0) {
+		curl_easy_setopt(ch->cp, CURLOPT_STDERR, stderr);
+	}
+
 	curl_easy_cleanup(ch->cp);
 #if LIBCURL_VERSION_NUM < 0x071101
 	zend_llist_clean(&ch->to_free.str);
@@ -2068,6 +2087,9 @@ static void _php_curl_close_ex(php_curl *ch TSRMLS_DC)
 	if (ch->handlers->passwd) {
 		zval_ptr_dtor(&ch->handlers->passwd);
 	}
+	if (ch->handlers->stderr) {
+		zval_ptr_dtor(&ch->handlers->stderr);
+	}
 	if (ch->header.str_len > 0) {
 		efree(ch->header.str);
 	}
diff --git a/ext/curl/php_curl.h b/ext/curl/php_curl.h
index 6f2931a7bc..071e69c6fe 100644
--- a/ext/curl/php_curl.h
+++ b/ext/curl/php_curl.h
@@ -101,6 +101,7 @@ typedef struct {
 	php_curl_write *write_header;
 	php_curl_read  *read;
 	zval           *passwd;
+	zval           *stderr;
 } php_curl_handlers;
 
 struct _php_curl_error  {