From: Wez Furlong <wez@php.net>
Date: Mon, 18 Apr 2005 16:22:38 +0000 (+0000)
Subject: Fix bugs #29583 and #31636
X-Git-Tag: php-5.0.5RC1~419
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bba259101ff64b08df0ef9d8bd5e3318d39c783a;p=php

Fix bugs #29583 and #31636
---

diff --git a/NEWS b/NEWS
index 50fb46b834..e6ec8b6504 100644
--- a/NEWS
+++ b/NEWS
@@ -27,11 +27,13 @@ PHP                                                                        NEWS
 - Fixed bug #32282 (Segfault in mysqli_fetch_array on 64-bit) (Georg).
 - Fixed bug #31887 (ISAPI: Custom 5xx error does not return correct HTTP 
   response message). (Jani)
+- Fixed bug #31636 (another crash when echoing a COM object). (Wez)
 - Fixed bug #31502 (Wrong deserialization from session when using WDDX
   serializer). (Dmitry) 
 - Fixed bug #31363 (broken non-blocking flock()). ian at snork dot net
 - Fixed bug #30833 (array_count_values() modifying input array). (Tony)
 - Fixed bug #30819 (Better support for LDAP SASL bind). (Jani)
+- Fixed bug #29583 (crash when echoing a COM object). (M.Sisolak, Wez)
 - Fixed bug #28839 (SIGSEGV in interactive mode (php -a)).
   (kameshj at fastmail dot fm)
 
diff --git a/ext/com_dotnet/com_handlers.c b/ext/com_dotnet/com_handlers.c
index cee0b41017..531c202733 100644
--- a/ext/com_dotnet/com_handlers.c
+++ b/ext/com_dotnet/com_handlers.c
@@ -524,14 +524,15 @@ static int com_object_cast(zval *readobj, zval *writeobj, int type, int should_f
 	php_com_dotnet_object *obj;
 	VARIANT v;
 	VARTYPE vt = VT_EMPTY;
+	zval free_obj;
+	HRESULT res = S_OK;
 
 	if (should_free) {
-		zval_dtor(writeobj);
+		free_obj = *writeobj;
 	}
 
-	ZVAL_NULL(writeobj);
-
 	obj = CDNO_FETCH(readobj);
+	ZVAL_NULL(writeobj);
 	VariantInit(&v);
 
 	if (V_VT(&obj->v) == VT_DISPATCH) {
@@ -564,12 +565,23 @@ static int com_object_cast(zval *readobj, zval *writeobj, int type, int should_f
 	}
 
 	if (vt != VT_EMPTY) {
-		VariantChangeType(&v, &v, 0, vt);
+		res = VariantChangeType(&v, &v, 0, vt);
+	}
+
+	if (SUCCEEDED(res)) {
+		php_com_zval_from_variant(writeobj, &v, obj->code_page TSRMLS_CC);
 	}
 
-	php_com_zval_from_variant(writeobj, &v, obj->code_page TSRMLS_CC);
 	VariantClear(&v);
-	return SUCCESS;
+	if (should_free) {
+		zval_dtor(&free_obj);
+	}
+
+	if (SUCCEEDED(res)) {
+		return SUCCESS;
+	}
+
+	return FAILURE;
 }
 
 static int com_object_count(zval *object, long *count TSRMLS_DC)