From: Adam Harvey <aharvey@php.net>
Date: Tue, 14 Sep 2010 10:58:59 +0000 (+0000)
Subject: Fix bug #52827 (cURL leaks handle and causes assertion error (CURLOPT_STDERR)).
X-Git-Tag: php-5.3.4RC1~236
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=877a6f92f069e3e2fee74bd4452e88733d633d5b;p=php

Fix bug #52827 (cURL leaks handle and causes assertion error (CURLOPT_STDERR)).
Patch by Gustavo.
---

diff --git a/NEWS b/NEWS
index 28fa9a9e5d..c73c363b36 100644
--- a/NEWS
+++ b/NEWS
@@ -21,6 +21,8 @@
 - Fixed possible crash in mssql_fetch_batch(). (Kalle)
 - Fixed inconsistent backlog default value (-1) in FPM on many systems. (fat)
 
+- Fixed bug #52827 (cURL leaks handle and causes assertion error
+  (CURLOPT_STDERR)). (Gustavo)
 - Fixed bug #52786 (PHP should reset section to [PHP] after ini sections).
   (Fedora at famillecollet dot com)
 - Fixed bug #52772 (var_dump() doesn't check for the existence of 
diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index f8b8e57635..ffb3e65e6d 100644
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -1816,7 +1816,6 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
 						}
 						zval_add_ref(zvalue);
 						ch->handlers->std_err = *zvalue;
-						zend_list_addref(Z_LVAL_PP(zvalue));
 					} else {
 						php_error_docref(NULL TSRMLS_CC, E_WARNING, "the provided file handle is not writable");
 						RETVAL_FALSE;
diff --git a/ext/curl/tests/bug52827.phpt b/ext/curl/tests/bug52827.phpt
new file mode 100644
index 0000000000..85a73fa797
--- /dev/null
+++ b/ext/curl/tests/bug52827.phpt
@@ -0,0 +1,32 @@
+--TEST--
+Bug #52827 (curl_setopt with CURLOPT_STDERR erroneously increments the resource refcount)
+--SKIPIF--
+<?php
+
+if (!extension_loaded('curl')) {
+	exit("skip curl extension not loaded");
+}
+
+?>
+--FILE--
+<?php
+$s = fopen('php://temp/maxmemory=1024','wb+');
+
+/* force conversion of inner stream to STDIO.
+ * This is not necessary in Windows because the
+ * cast to a FILE* handle in curl_setopt already
+ * forces the conversion in that platform. The
+ * reason for this conversion is that the memory
+ * stream has an ugly but working mechanism to
+ * prevent being double freed when it's encapsulated,
+ * while STDIO streams don't. */
+$i = 0;
+while ($i++ < 5000) {
+fwrite($s, str_repeat('a',1024));
+}
+$handle=curl_init('http://www.example.com');
+curl_setopt($handle, CURLOPT_STDERR, $s);
+
+echo "Done.";
+--EXPECTF--
+Done.