From 91bad929aa0d7b7560a20c58e1e02a76f522b0bd Mon Sep 17 00:00:00 2001
From: Adam Harvey <aharvey@php.net>
Date: Tue, 1 Dec 2015 03:09:36 +0000
Subject: [PATCH] Fix bug #71005 (Segfault in
 php_cli_server_dispatch_router()).

We didn't initialise the retval variable in
php_cli_server_dispatch_router(); let's now initialise it to be
IS_UNDEF, as the following if condition expects.
---
 NEWS                         |  3 +++
 sapi/cli/php_cli_server.c    |  2 ++
 sapi/cli/tests/bug71005.phpt | 46 ++++++++++++++++++++++++++++++++++++
 3 files changed, 51 insertions(+)
 create mode 100644 sapi/cli/tests/bug71005.phpt

diff --git a/NEWS b/NEWS
index 42be771f17..f34409e70e 100644
--- a/NEWS
+++ b/NEWS
@@ -24,6 +24,9 @@ PHP                                                                        NEWS
   . Fixed exception not being thrown immediately into a generator yielding
     from an array. (Bob)
 
+- CLI server:
+  . Fixed bug #71005 (Segfault in php_cli_server_dispatch_router()). (Adam)
+
 - Mysqlnd:
   . Fixed bug #68077 (LOAD DATA LOCAL INFILE / open_basedir restriction).
     (Laruence)
diff --git a/sapi/cli/php_cli_server.c b/sapi/cli/php_cli_server.c
index 529f5633bf..3e9bb3af8f 100644
--- a/sapi/cli/php_cli_server.c
+++ b/sapi/cli/php_cli_server.c
@@ -2050,6 +2050,8 @@ static int php_cli_server_dispatch_router(php_cli_server *server, php_cli_server
 
 	zend_try {
 		zval retval;
+
+		ZVAL_UNDEF(&retval);
 		if (SUCCESS == zend_execute_scripts(ZEND_REQUIRE, &retval, 1, &zfd)) {
 			if (Z_TYPE(retval) != IS_UNDEF) {
 				decline = Z_TYPE(retval) == IS_FALSE;
diff --git a/sapi/cli/tests/bug71005.phpt b/sapi/cli/tests/bug71005.phpt
new file mode 100644
index 0000000000..3a60dcf42f
--- /dev/null
+++ b/sapi/cli/tests/bug71005.phpt
@@ -0,0 +1,46 @@
+--TEST--
+Bug #71005 (Segfault in php_cli_server_dispatch_router())
+--SKIPIF--
+<?php
+include "skipif.inc"; 
+?>
+--FILE--
+<?php
+
+$code = <<<'EOF'
+set_exception_handler(function () { echo 'goodbye'; });
+throw new Exception;
+EOF;
+
+include "php_cli_server.inc";
+php_cli_server_start($code);
+
+list($host, $port) = explode(':', PHP_CLI_SERVER_ADDRESS);
+$port = intval($port) ?: 80;
+
+$fp = fsockopen($host, $port, $errno, $errstr, 0.5);
+if (!$fp) {
+  die("connect failed");
+}
+
+if(fwrite($fp, <<<HEADER
+GET / HTTP/1.1
+Host: {$host}
+
+
+HEADER
+)) {
+	while (!feof($fp)) {
+		echo fgets($fp);
+	}
+}
+
+?>
+--EXPECTF--	
+HTTP/1.1 200 OK
+Host: %s
+Connection: close
+X-Powered-By: PHP/%s
+Content-type: text/html; charset=UTF-8
+
+goodbye
-- 
2.40.0