tony2001 Mon Feb 26 09:14:41 2007 UTC
Modified files: (Branch: PHP_4_4)
/php-src NEWS
/php-src/ext/curl curl.c
Log:
fix #40635 (segfault in cURL extension)
http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.1247.2.920.2.199&r2=1.1247.2.920.2.200&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.1247.2.920.2.199 php-src/NEWS:1.1247.2.920.2.200
--- php-src/NEWS:1.1247.2.920.2.199 Fri Feb 23 20:53:23 2007
+++ php-src/NEWS Mon Feb 26 09:14:40 2007
@@ -2,6 +2,7 @@
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? Feb 2007, Version 4.4.6
+- Fixed bug #40635 (segfault in cURL extension). (Tony)
- Fixed bug #40611 (possible cURL memory error). (Tony)
22 Feb 2007, Version 4.4.6RC1
http://cvs.php.net/viewvc.cgi/php-src/ext/curl/curl.c?r1=1.124.2.30.2.17&r2=1.124.2.30.2.18&diff_format=u
Index: php-src/ext/curl/curl.c
diff -u php-src/ext/curl/curl.c:1.124.2.30.2.17
php-src/ext/curl/curl.c:1.124.2.30.2.18
--- php-src/ext/curl/curl.c:1.124.2.30.2.17 Fri Feb 23 20:53:24 2007
+++ php-src/ext/curl/curl.c Mon Feb 26 09:14:41 2007
@@ -16,7 +16,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: curl.c,v 1.124.2.30.2.17 2007/02/23 20:53:24 tony2001 Exp $ */
+/* $Id: curl.c,v 1.124.2.30.2.18 2007/02/26 09:14:41 tony2001 Exp $ */
#ifdef HAVE_CONFIG_H
#include "config.h"
@@ -1266,8 +1266,9 @@
return;
}
- if (ch->handlers->write->buf.len) {
- memset(&ch->handlers->write->buf, 0, sizeof(smart_str));
+ if (ch->handlers->write->buf.len > 0) {
+ smart_str_free(&ch->handlers->write->buf);
+ ch->handlers->write->buf.len = 0;
}
memset(ch->err.str, 0, CURL_ERROR_SIZE + 1);
@@ -1297,6 +1298,7 @@
if (error != CURLE_OK && error != CURLE_PARTIAL_FILE) {
if (ch->handlers->write->buf.len > 0) {
smart_str_free(&ch->handlers->write->buf);
+ ch->handlers->write->buf.len = 0;
}
RETURN_FALSE;
@@ -1306,9 +1308,10 @@
if (ch->handlers->write->method == PHP_CURL_RETURN &&
ch->handlers->write->buf.len > 0) {
--ch->uses;
- if (ch->handlers->write->type != PHP_CURL_BINARY)
+ if (ch->handlers->write->type != PHP_CURL_BINARY) {
smart_str_0(&ch->handlers->write->buf);
- RETURN_STRINGL(ch->handlers->write->buf.c,
ch->handlers->write->buf.len, 0);
+ }
+ RETURN_STRINGL(ch->handlers->write->buf.c,
ch->handlers->write->buf.len, 1);
}
--ch->uses;
if (ch->handlers->write->method == PHP_CURL_RETURN) {
@@ -1533,6 +1536,10 @@
zend_llist_clean(&ch->to_free.slist);
zend_llist_clean(&ch->to_free.post);
+ if (ch->handlers->write->buf.len > 0) {
+ smart_str_free(&ch->handlers->write->buf);
+ ch->handlers->write->buf.len = 0;
+ }
if (ch->handlers->write->func) {
FREE_ZVAL(ch->handlers->write->func);
ch->handlers->read->func = NULL;
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
