fix bug #73055

diff --git a/.gitignore b/.gitignore
index 33cd7c687a992d6d9af9f31241721121c64a3040..45ac1a5f203ae766bd3662ce1fe7a59e677ceb02 100644 (file)
--- a/.gitignore
+++ b/.gitignore
@@ -42,3 +42,36 @@ lcov_data
 *.phar
 vendor/
 tests/helper/server.log
 *.phar
 vendor/
 tests/helper/server.log

+php_http_api.h
+php_http_buffer.h
+php_http_client.h
+php_http_client_curl.h
+php_http_client_curl_event.h
+php_http_client_curl_user.h
+php_http_client_request.h
+php_http_client_response.h
+php_http_cookie.h
+php_http_curl.h
+php_http_encoding.h
+php_http_env.h
+php_http_env_request.h
+php_http_env_response.h
+php_http_etag.h
+php_http_exception.h
+php_http_filter.h
+php_http_header.h
+php_http_header_parser.h
+php_http_info.h
+php_http_message.h
+php_http_message_body.h
+php_http_message_parser.h
+php_http_misc.h
+php_http_negotiate.h
+php_http_object.h
+php_http_options.h
+php_http_params.h
+php_http_querystring.h
+php_http_response_codes.h
+php_http_url.h
+php_http_utf8.h
+php_http_version.h

diff --git a/package.xml b/package.xml
index 0e2206660d33b672e59773cc1f375b5293d7956d..7191f314ad8cc64d1d99491e09010f271a89ae9c 100644 (file)
--- a/package.xml
+++ b/package.xml
@@ -31,9 +31,9 @@ https://mdref.m6w6.name/http
   <email>mike@php.net</email>
   <active>yes</active>
  </lead>
   <email>mike@php.net</email>
   <active>yes</active>
  </lead>

- <date>2016-09-07</date>
+ <date>2016-09-12</date>

  <version>
  <version>

-  <release>2.6.0beta2</release>
+  <release>2.6.0RC1</release>

   <api>2.6.0</api>
  </version>
  <stability>
   <api>2.6.0</api>
  </version>
  <stability>


@@ -69,6 +69,10 @@ https://mdref.m6w6.name/http
 Changes from beta1:
 * Fixed PHP-5.3 compatibility
 * Fixed recursive calls to the event loop dispatcher
 Changes from beta1:
 * Fixed PHP-5.3 compatibility
 * Fixed recursive calls to the event loop dispatcher

+
+Changes from beta2:
+* Fix bug #73055: crash in http\QueryString (Mike, @rc0r)
+* Fix HTTP/2 version parser for older libcurl versions (Mike)

 ]]></notes>
  <contents>
   <dir name="/">
 ]]></notes>
  <contents>
   <dir name="/">


@@ -185,6 +189,7 @@ Changes from beta1:
      <file role="test" name="bug69313.phpt"/>
      <file role="test" name="bug69357.phpt"/>
      <file role="test" name="bug71719.phpt"/>
      <file role="test" name="bug69313.phpt"/>
      <file role="test" name="bug69357.phpt"/>
      <file role="test" name="bug71719.phpt"/>

+     <file role="test" name="bug73055.phpt"/>

      <file role="test" name="client001.phpt"/>
      <file role="test" name="client002.phpt"/>
      <file role="test" name="client003.phpt"/>
      <file role="test" name="client001.phpt"/>
      <file role="test" name="client002.phpt"/>
      <file role="test" name="client003.phpt"/>

diff --git a/src/php_http_params.c b/src/php_http_params.c
index fc75f0e96140151f52e918ec8136cbf9140c8304..90710684deabe6d08bd5e81d8e1563086f0095a6 100644 (file)
--- a/src/php_http_params.c
+++ b/src/php_http_params.c
@@ -470,7 +470,7 @@ static void merge_param(HashTable *params, zval *zdata, zval ***current_param, z
                        while (Z_TYPE_PP(zdata_ptr) == IS_ARRAY
                        &&      SUCCESS == zend_hash_get_current_data(Z_ARRVAL_PP(zdata_ptr), (void *) &test_ptr)
                        ) {
                        while (Z_TYPE_PP(zdata_ptr) == IS_ARRAY
                        &&      SUCCESS == zend_hash_get_current_data(Z_ARRVAL_PP(zdata_ptr), (void *) &test_ptr)
                        ) {

-                               if (Z_TYPE_PP(test_ptr) == IS_ARRAY) {
+                               if (Z_TYPE_PP(test_ptr) == IS_ARRAY && Z_TYPE_PP(ptr) == IS_ARRAY) {

 
                                        /* now find key in ptr */
                                        if (HASH_KEY_IS_STRING == zend_hash_get_current_key_ex(Z_ARRVAL_PP(zdata_ptr), &hkey.str, &hkey.len, &hkey.num, hkey.dup, NULL)) {
 
                                        /* now find key in ptr */
                                        if (HASH_KEY_IS_STRING == zend_hash_get_current_key_ex(Z_ARRVAL_PP(zdata_ptr), &hkey.str, &hkey.len, &hkey.num, hkey.dup, NULL)) {