svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/ext/standard/tests/streams/bug61115.phpt branches/PHP_5_3/main/streams/streams.c
trunk/ext/standard/tests/streams/bug61115.phpt trunk/main/streams/streams.c

cataphract Wed, 22 Feb 2012 11:45:26 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=323425 Log: - Fixed bug #61115 (stream related segfault on fatal error in php_stream_context_link). #run-tests.php is not currently detecting the segfault in the test #Missing 5.4 merge Bug: https://bugs.php.net/61115 (Analyzed) Stream related segfault on fatal error in php_stream_context_del_link Changed paths: U php/php-src/branches/PHP_5_3/NEWS A php/php-src/branches/PHP_5_3/ext/standard/tests/streams/bug61115.phpt U php/php-src/branches/PHP_5_3/main/streams/streams.c A php/php-src/trunk/ext/standard/tests/streams/bug61115.phpt U php/php-src/trunk/main/streams/streams.c Modified: php/php-src/branches/PHP_5_3/NEWS =================================================================== --- php/php-src/branches/PHP_5_3/NEWS 2012-02-22 11:15:49 UTC (rev 323424) +++ php/php-src/branches/PHP_5_3/NEWS 2012-02-22 11:45:26 UTC (rev 323425) @@ -29,6 +29,8 @@ . Fixed bug #60802 (ibase_trans() gives segfault when passing params). - Streams: + . Fixed bug #61115 (stream related segfault on fatal error in + php_stream_context_link). (Gustavo) . Further fix for bug #60455 (stream_get_line misbehaves if EOF is not detected together with the last read). (Gustavo) . Fixed bug #60817 (stream_get_line() reads from stream even when there is Added: php/php-src/branches/PHP_5_3/ext/standard/tests/streams/bug61115.phpt =================================================================== --- php/php-src/branches/PHP_5_3/ext/standard/tests/streams/bug61115.phpt (rev 0) +++ php/php-src/branches/PHP_5_3/ext/standard/tests/streams/bug61115.phpt 2012-02-22 11:45:26 UTC (rev 323425) @@ -0,0 +1,13 @@ +--TEST-- +Bug #61115: Stream related segfault on fatal error in php_stream_context_del_link. +--FILE-- +<?php + +$arrayLarge = array_fill(0, 113663, '*'); + +$resourceFileTemp = fopen('php://temp', 'r+'); +stream_context_set_params($resourceFileTemp, array()); +preg_replace('', function() {}, $resourceFileTemp); +?> +--EXPECTF-- +Catchable fatal error: Object of class Closure could not be converted to string in %s on line %d Property changes on: php/php-src/branches/PHP_5_3/ext/standard/tests/streams/bug61115.phpt ___________________________________________________________________ Added: svn:keywords + Id Rev Revision Added: svn:eol-style + native Modified: php/php-src/branches/PHP_5_3/main/streams/streams.c =================================================================== --- php/php-src/branches/PHP_5_3/main/streams/streams.c 2012-02-22 11:15:49 UTC (rev 323424) +++ php/php-src/branches/PHP_5_3/main/streams/streams.c 2012-02-22 11:45:26 UTC (rev 323425) @@ -320,7 +320,9 @@ int remove_rsrc = 1; int preserve_handle = close_options & PHP_STREAM_FREE_PRESERVE_HANDLE ? 1 : 0; int release_cast = 1; - php_stream_context *context = stream->context; + /* on an unclean shutdown, the context may have already been freed (if it + * was created after the stream resource), so don't reference it */ + php_stream_context *context = CG(unclean_shutdown) ? NULL : stream->context; if (stream->flags & PHP_STREAM_FLAG_NO_CLOSE) { preserve_handle = 1; @@ -374,8 +376,8 @@ } /* Remove stream from any context link list */ - if (stream->context && stream->context->links) { - php_stream_context_del_link(stream->context, stream); + if (context && context->links) { + php_stream_context_del_link(context, stream); } if (close_options & PHP_STREAM_FREE_CALL_DTOR) { Added: php/php-src/trunk/ext/standard/tests/streams/bug61115.phpt =================================================================== --- php/php-src/trunk/ext/standard/tests/streams/bug61115.phpt (rev 0) +++ php/php-src/trunk/ext/standard/tests/streams/bug61115.phpt 2012-02-22 11:45:26 UTC (rev 323425) @@ -0,0 +1,13 @@ +--TEST-- +Bug #61115: Stream related segfault on fatal error in php_stream_context_del_link. +--FILE-- +<?php + +$arrayLarge = array_fill(0, 113663, '*'); + +$resourceFileTemp = fopen('php://temp', 'r+'); +stream_context_set_params($resourceFileTemp, array()); +preg_replace('', function() {}, $resourceFileTemp); +?> +--EXPECTF-- +Catchable fatal error: Object of class Closure could not be converted to string in %s on line %d Property changes on: php/php-src/trunk/ext/standard/tests/streams/bug61115.phpt ___________________________________________________________________ Added: svn:keywords + Id Rev Revision Added: svn:eol-style + native Modified: php/php-src/trunk/main/streams/streams.c =================================================================== --- php/php-src/trunk/main/streams/streams.c 2012-02-22 11:15:49 UTC (rev 323424) +++ php/php-src/trunk/main/streams/streams.c 2012-02-22 11:45:26 UTC (rev 323425) @@ -366,7 +366,9 @@ int ret = 1; int preserve_handle = close_options & PHP_STREAM_FREE_PRESERVE_HANDLE ? 1 : 0; int release_cast = 1; - php_stream_context *context = stream->context; + /* on an unclean shutdown, the context may have already been freed (if it + * was created after the stream resource), so don't reference it */ + php_stream_context *context = CG(unclean_shutdown) ? NULL : stream->context; if (stream->flags & PHP_STREAM_FLAG_NO_CLOSE) { preserve_handle = 1;