From f9e8477b0411432fc85aaa2933f4950a8aaa0748 Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikic@php.net>
Date: Sun, 19 Feb 2012 14:39:29 +0000
Subject: [PATCH] Fix bug #61139 gzopen leaks when specifying invalid mode

Needs to be merged to 5.4.
---
 ext/zlib/tests/bug61139.phpt  | 14 ++++++++++++++
 ext/zlib/zlib_fopen_wrapper.c | 25 ++++++++++---------------
 2 files changed, 24 insertions(+), 15 deletions(-)
 create mode 100644 ext/zlib/tests/bug61139.phpt

diff --git a/ext/zlib/tests/bug61139.phpt b/ext/zlib/tests/bug61139.phpt
new file mode 100644
index 0000000000..eaca00369b
--- /dev/null
+++ b/ext/zlib/tests/bug61139.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #61139 (gzopen leaks when specifying invalid mode)
+--SKIPIF--
+<?php 
+if (!extension_loaded('zlib')) {
+	die('skip - zlib extension not loaded'); 
+}	 
+?>
+--FILE--
+<?php
+
+gzopen('someFile', 'c');
+--EXPECTF--
+Warning: gzopen(): gzopen failed in %s on line %d
diff --git a/ext/zlib/zlib_fopen_wrapper.c b/ext/zlib/zlib_fopen_wrapper.c
index f60be73b72..71958d82e9 100644
--- a/ext/zlib/zlib_fopen_wrapper.c
+++ b/ext/zlib/zlib_fopen_wrapper.c
@@ -109,7 +109,7 @@ static php_stream_ops php_stream_gzio_ops = {
 php_stream *php_stream_gzopen(php_stream_wrapper *wrapper, char *path, char *mode, int options, 
 							  char **opened_path, php_stream_context *context STREAMS_DC TSRMLS_DC)
 {
-	struct php_gz_stream_data_t *self = {0};
+	struct php_gz_stream_data_t *self;
 	php_stream *stream = NULL, *innerstream = NULL;
 
 	/* sanity check the stream: it can be either read-only or write-only */
@@ -120,8 +120,6 @@ php_stream *php_stream_gzopen(php_stream_wrapper *wrapper, char *path, char *mod
 		return NULL;
 	}
 	
-	self = emalloc(sizeof(*self));
-
 	if (strncasecmp("compress.zlib://", path, 16) == 0) {
 		path += 16;
 	} else if (strncasecmp("zlib:", path, 5) == 0) {
@@ -134,32 +132,29 @@ php_stream *php_stream_gzopen(php_stream_wrapper *wrapper, char *path, char *mod
 		int fd;
 
 		if (SUCCESS == php_stream_cast(innerstream, PHP_STREAM_AS_FD, (void **) &fd, REPORT_ERRORS)) {
-			self->gz_file = gzdopen(dup(fd), mode);
+			self = emalloc(sizeof(*self));
 			self->stream = innerstream;
-			if (self->gz_file)	{
+			self->gz_file = gzdopen(dup(fd), mode);
+
+			if (self->gz_file) {
 				stream = php_stream_alloc_rel(&php_stream_gzio_ops, self, 0, mode);
 				if (stream) {
 					stream->flags |= PHP_STREAM_FLAG_NO_BUFFER;
 					return stream;
 				}
+
 				gzclose(self->gz_file);
 			}
+
+			efree(self);
 			if (options & REPORT_ERRORS) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "gzopen failed");
 			}
-		} else if (innerstream) {
-			php_stream_close(innerstream);
 		}
-	}
 
-	if (stream) {
-		php_stream_close(stream);
-	}
-	
-	if (self) {
-		efree(self);
+		php_stream_close(innerstream);
 	}
-	
+
 	return NULL;
 }
 
-- 
2.40.0