From: Michael Wallner <mike@php.net>
Date: Tue, 27 Apr 2010 13:42:32 +0000 (+0000)
Subject: fixed bug #17087    http_build_cookie() exhausts memory if cookie value is NULL
X-Git-Tag: RELEASE_1_7_0~11
X-Git-Url: https://git.m6w6.name/?a=commitdiff_plain;h=bf7172546a6b22d1c15811f1601800f810107dde;p=m6w6%2Fext-http

fixed bug #17087    http_build_cookie() exhausts memory if cookie value is NULL
---

diff --git a/http_cookie_api.c b/http_cookie_api.c
index 081143d..5776b87 100644
--- a/http_cookie_api.c
+++ b/http_cookie_api.c
@@ -323,7 +323,9 @@ PHP_HTTP_API void _http_cookie_list_tostring(http_cookie_list *list, char **str,
 	
 	FOREACH_HASH_KEYVAL(pos, &list->cookies, key, val) {
 		if (key.type == HASH_KEY_IS_STRING && key.len) {
-			append_encoded(&buf, key.str, key.len-1, Z_STRVAL_PP(val), Z_STRLEN_PP(val));
+			zval *tmp = http_zsep(IS_STRING, *val);
+			append_encoded(&buf, key.str, key.len-1, Z_STRVAL_P(tmp), Z_STRLEN_P(tmp));
+			zval_ptr_dtor(&tmp);
 		}
 	}
 	
@@ -341,7 +343,8 @@ PHP_HTTP_API void _http_cookie_list_tostring(http_cookie_list *list, char **str,
 	
 	FOREACH_HASH_KEYVAL(pos, &list->extras, key, val) {
 		if (key.type == HASH_KEY_IS_STRING && key.len) {
-			append_encoded(&buf, key.str, key.len-1, Z_STRVAL_PP(val), Z_STRLEN_PP(val));
+			zval *tmp = http_zsep(IS_STRING, *val);
+			append_encoded(&buf, key.str, key.len-1, Z_STRVAL_P(tmp), Z_STRLEN_P(tmp));
 		}
 	}
 	
diff --git a/package.xml b/package.xml
index d43001f..bb75602 100644
--- a/package.xml
+++ b/package.xml
@@ -28,13 +28,13 @@ support. Parallel requests are available for PHP 5 and greater.
   <email>mike@php.net</email>
   <active>yes</active>
  </lead>
- <date>2009-12-29</date>
+ <date>2010-04-29</date>
  <version>
-  <release>1.7.0b2</release>
+  <release>1.7.0</release>
   <api>1.7.0</api>
  </version>
  <stability>
-  <release>beta</release>
+  <release>stable</release>
   <api>stable</api>
  </stability>
  <license>BSD, revised</license>
@@ -52,6 +52,7 @@ support. Parallel requests are available for PHP 5 and greater.
  - HTTP_PROXY_HTTP_1_0
 * Added request info members:
  - condition_unmet (libcurl >= 7.19.4)
+* Fixed bug #17087 http_build_cookie() exhausts memory if cookie value is NULL
 ]]></notes>
  <contents>
   <dir name="/">