From: Andrei Zmievski <andrei@php.net>
Date: Tue, 25 Jan 2005 22:00:14 +0000 (+0000)
Subject: MFB (Fix several egregious leaks in ext/browscap and sapi/embed).
X-Git-Tag: php-5.0.4RC1~246
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=86b2558a5e7ee33804f413f41cbe1dfb4bcffd85;p=php

MFB (Fix several egregious leaks in ext/browscap and sapi/embed).
---

diff --git a/NEWS b/NEWS
index c6fd9eeca7..05a87a69f2 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2005, PHP 5.0.4
+- Fixed several egregious leaks in ext/browscap and sapi/embed. (Andrei)
 - Added Oracle Instant Client support. (cjbj at hotmail dot com, Tony)
 - Added length and charsetnr for field array and object in mysqli. (Georg)
 - Changed foreach() to throw an exception if IteratorAggregate::getIterator()
diff --git a/ext/standard/browscap.c b/ext/standard/browscap.c
index 2baf3735b1..77534f410c 100644
--- a/ext/standard/browscap.c
+++ b/ext/standard/browscap.c
@@ -33,12 +33,17 @@ static zval *current_section;
 
 /* OBJECTS_FIXME: This whole extension needs going through. The use of objects looks pretty broken here */
 
-static void browscap_entry_dtor(zval *pvalue)
+static void browscap_entry_dtor(zval **pvalue)
 {
-	if (Z_TYPE_P(pvalue) == IS_ARRAY) {
-		zend_hash_destroy(Z_ARRVAL_P(pvalue));
-		free(Z_ARRVAL_P(pvalue));
+	if (Z_TYPE_PP(pvalue) == IS_ARRAY) {
+		zend_hash_destroy(Z_ARRVAL_PP(pvalue));
+		free(Z_ARRVAL_PP(pvalue));
+	} else if (Z_TYPE_PP(pvalue) == IS_STRING) {
+		if (Z_STRVAL_PP(pvalue) && Z_STRVAL_PP(pvalue) != empty_string) {
+			free(Z_STRVAL_PP(pvalue));
+		}
 	}
+	free(*pvalue);
 }
 
 /* {{{ convert_browscap_pattern
@@ -97,7 +102,7 @@ static void php_browscap_parser_cb(zval *arg1, zval *arg2, int callback_type, vo
 
 				new_property = (zval *) malloc(sizeof(zval));
 				INIT_PZVAL(new_property);
-				Z_STRVAL_P(new_property) = Z_STRLEN_P(arg2)?zend_strndup(Z_STRVAL_P(arg2), Z_STRLEN_P(arg2)):"";
+				Z_STRVAL_P(new_property) = Z_STRLEN_P(arg2)?zend_strndup(Z_STRVAL_P(arg2), Z_STRLEN_P(arg2)):empty_string;
 				Z_STRLEN_P(new_property) = Z_STRLEN_P(arg2);
 				Z_TYPE_P(new_property) = IS_STRING;
 
@@ -123,6 +128,7 @@ static void php_browscap_parser_cb(zval *arg1, zval *arg2, int callback_type, vo
 				section_properties = (HashTable *) malloc(sizeof(HashTable));
 				zend_hash_init(section_properties, 0, NULL, (dtor_func_t) browscap_entry_dtor, 1);
 				current_section->value.ht = section_properties;
+				current_section->type = IS_ARRAY;
 				zend_hash_update(&browser_hash, Z_STRVAL_P(arg1), Z_STRLEN_P(arg1)+1, (void *) &current_section, sizeof(zval *), NULL);
 
 				Z_STRVAL_P(processed) = Z_STRVAL_P(arg1);
diff --git a/sapi/embed/php_embed.c b/sapi/embed/php_embed.c
index 1d72ef9df9..eb7de7927b 100644
--- a/sapi/embed/php_embed.c
+++ b/sapi/embed/php_embed.c
@@ -210,6 +210,7 @@ void php_embed_shutdown(TSRMLS_D)
 {
 	php_request_shutdown((void *) 0);
 	php_module_shutdown(TSRMLS_C);
+	sapi_shutdown();
 #ifdef ZTS
     tsrm_shutdown();
 #endif