From: Scott MacVicar <scottmac@php.net>
Date: Mon, 18 Jun 2007 15:52:46 +0000 (+0000)
Subject: Fixed bug #41628 (PHP settings leak between Virtual Hosts in Apache 1.3).
X-Git-Tag: php-5.2.4RC1~331
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b73d2a94ae615cb530b8cc9548d1a2bd06b57ed4;p=php

Fixed bug #41628 (PHP settings leak between Virtual Hosts in Apache 1.3).
---

diff --git a/NEWS b/NEWS
index af49dfce79..1fd1724395 100644
--- a/NEWS
+++ b/NEWS
@@ -39,6 +39,8 @@ PHP                                                                        NEWS
   constants). (Dmitry)
 - Fixed bug #41630 (segfault when an invalid color index is present in
   the image data). (Reported by Elliot <wccoder@gmail dot com>) (Pierre)
+- Fixed bug #41628 (PHP settings leak between Virtual Hosts in
+  Apache 1.3). (Scott, manuel at mausz dot at)
 - Fixed bug #41608 (segfault on a weird code with objects and switch()). 
   (Tony)
 - Fixed bug #41600 (url rewriter tags doesn't work with namespaced tags).
diff --git a/sapi/apache/mod_php5.c b/sapi/apache/mod_php5.c
index 344e705028..439ef168e7 100644
--- a/sapi/apache/mod_php5.c
+++ b/sapi/apache/mod_php5.c
@@ -764,9 +764,15 @@ static void *php_create_dir(pool *p, char *dummy)
  */
 static void *php_merge_dir(pool *p, void *basev, void *addv)
 {
-	/* This function *must* return addv, and not modify basev */
-	zend_hash_merge_ex((HashTable *) addv, (HashTable *) basev, (copy_ctor_func_t) copy_per_dir_entry, sizeof(php_per_dir_entry), (merge_checker_func_t) should_overwrite_per_dir_entry, NULL);
-	return addv;
+	/* This function *must* not modify addv or basev */
+	HashTable *new;
+
+	/* need a copy of addv to merge */
+	new = php_create_dir(p, "php_merge_dir");
+	zend_hash_copy(new, (HashTable *) addv, (copy_ctor_func_t) copy_per_dir_entry, NULL, sizeof(php_per_dir_entry));
+
+	zend_hash_merge_ex(new, (HashTable *) basev, (copy_ctor_func_t) copy_per_dir_entry, sizeof(php_per_dir_entry), (merge_checker_func_t) should_overwrite_per_dir_entry, NULL);
+	return new;
 }
 /* }}} */