cvs: php4 /main output.c

yohgaki Fri May 3 23:02:51 2002 EDT Modified files: /php4/main output.c Log: Fixed crash when buffer is over written in ob callback. (Bug $ 12227) Added check current output function check for Centent-Length header. @ Fixed output buffer crash when buffer is over written in callback. (Yasuo) Index: php4/main/output.c diff -u php4/main/output.c:1.95 php4/main/output.c:1.96 --- php4/main/output.c:1.95 Fri May 3 04:00:41 2002 +++ php4/main/output.c Fri May 3 23:02:51 2002 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: output.c,v 1.95 2002/05/03 08:00:41 thies Exp $ */ +/* $Id: output.c,v 1.96 2002/05/04 03:02:51 yohgaki Exp $ */ #include "php.h" #include "ext/standard/head.h" @@ -186,7 +186,7 @@ zval *z_status; ALLOC_INIT_ZVAL(orig_buffer); - ZVAL_STRINGL(orig_buffer, OG(active_ob_buffer).buffer, OG(active_ob_buffer).text_length, 0); + ZVAL_STRINGL(orig_buffer, OG(active_ob_buffer).buffer, OG(active_ob_buffer).text_length, 1); orig_buffer->refcount=2; /* don't let call_user_function() destroy our buffer */ orig_buffer->is_ref=1; @@ -203,10 +203,10 @@ } OG(ob_lock) = 0; zval_ptr_dtor(&OG(active_ob_buffer).output_handler); - if (orig_buffer->refcount==2) { /* free the zval */ + orig_buffer->refcount -=2; + if (orig_buffer->refcount <= 0) { /* free the zval */ + zval_dtor(orig_buffer); FREE_ZVAL(orig_buffer); - } else { - orig_buffer->refcount-=2; } zval_ptr_dtor(&z_status); zval_ptr_dtor(&OG(active_ob_buffer).output_handler); @@ -250,7 +250,7 @@ if (send_buffer) { /* FIXME: chunked output behavior is needed to be checked. (Yasuo) */ - if (OG(ob_nesting_level) == 0 && !OG(active_ob_buffer).erase && status == (PHP_OUTPUT_HANDLER_START|PHP_OUTPUT_HANDLER_END)) + if (OG(php_body_write) == php_ub_body_write && OG(ob_nesting_level) == 0 && !OG(active_ob_buffer).erase && status == (PHP_OUTPUT_HANDLER_START|PHP_OUTPUT_HANDLER_END)) ADD_CL_HEADER(final_buffer_length); OG(php_body_write)(final_buffer, final_buffer_length TSRMLS_CC); }