From: Michael Wallner <mike@php.net>
Date: Wed, 20 Sep 2017 14:25:41 +0000 (+0200)
Subject: --crashes; ++leaks;
X-Git-Tag: RELEASE_3_2_0_RC1~46
X-Git-Url: https://git.m6w6.name/?p=m6w6%2Fext-http;a=commitdiff_plain;h=3f49890b5a7dc529507f65d03e5118a74fa008d9

--crashes; ++leaks;
---

diff --git a/src/php_http_message.c b/src/php_http_message.c
index 3f08ee4..413edab 100644
--- a/src/php_http_message.c
+++ b/src/php_http_message.c
@@ -616,18 +616,18 @@ static void php_http_message_object_prophandler_get_headers(php_http_message_obj
 	array_copy(&obj->message->hdrs, Z_ARRVAL_P(return_value));
 }
 static void php_http_message_object_prophandler_set_headers(php_http_message_object_t *obj, zval *value) {
-	HashTable *headers;
-	zval *orig_value = value;
+	int converted = 0;
 
 	if (Z_TYPE_P(value) != IS_ARRAY && Z_TYPE_P(value) != IS_OBJECT) {
-		convert_to_array_ex(value);
+		converted = 1;
+		SEPARATE_ZVAL(value);
+		convert_to_array(value);
 	}
-	headers = HASH_OF(value);
 
 	zend_hash_clean(&obj->message->hdrs);
-	array_copy(headers, &obj->message->hdrs);
+	array_copy(HASH_OF(value), &obj->message->hdrs);
 
-	if (orig_value != value) {
+	if (converted) {
 		zval_ptr_dtor(value);
 	}
 }
@@ -785,6 +785,7 @@ ZEND_RESULT_CODE php_http_message_object_set_body(php_http_message_object_t *msg
 
 	if (!body_obj->body) {
 		body_obj->body = php_http_message_body_init(NULL, NULL);
+		php_stream_to_zval(php_http_message_body_stream(body_obj->body), body_obj->gc);
 	}
 	if (msg_obj->body) {
 		zend_object_release(&msg_obj->body->zo);
@@ -882,12 +883,13 @@ static zval *php_http_message_object_read_prop(zval *object, zval *member, int t
 
 		if (handler) {
 			php_http_message_object_t *obj = PHP_HTTP_OBJ(NULL, object);
+			zval tmp2;
 
 			PHP_HTTP_MESSAGE_OBJECT_INIT(obj);
-			handler->read(obj, tmp);
+			handler->read(obj, &tmp2);
 
-			//zval_ptr_dtor(return_value);
-			ZVAL_COPY_VALUE(return_value, tmp);
+			zval_ptr_dtor(return_value);
+			ZVAL_COPY_VALUE(return_value, &tmp2);
 		}
 		zend_string_release(member_name);
 		return return_value;
@@ -1102,7 +1104,6 @@ static PHP_METHOD(HttpMessage, getBody)
 
 	if (!obj->body) {
 		php_http_message_object_init_body_object(obj);
-
 	}
 	if (obj->body) {
 		RETVAL_OBJECT(&obj->body->zo, 1);
diff --git a/src/php_http_message_body.c b/src/php_http_message_body.c
index 18859a3..18ff936 100644
--- a/src/php_http_message_body.c
+++ b/src/php_http_message_body.c
@@ -90,9 +90,9 @@ void php_http_message_body_free(php_http_message_body_t **body_ptr)
 {
 	if (*body_ptr) {
 		php_http_message_body_t *body = *body_ptr;
-
 		if (!--body->refcount) {
-			zend_list_delete(body->res);
+			zend_list_close(body->res);
+			body->res = NULL;
 			PTR_FREE(body->boundary);
 			efree(body);
 		}
@@ -570,8 +570,6 @@ php_http_message_body_object_t *php_http_message_body_object_new_ex(zend_class_e
 
 	if (body) {
 		o->body = body;
-		php_stream_to_zval(php_http_message_body_stream(o->body), o->gc);
-
 	}
 
 	o->zo.handlers = &php_http_message_body_object_handlers;
@@ -597,12 +595,18 @@ static HashTable *php_http_message_body_object_get_gc(zval *object, zval **table
 	HashTable *props = Z_OBJPROP_P(object);
 	uint32_t count = zend_hash_num_elements(props);
 
-	*n = 1;
+	obj->gc = erealloc(obj->gc, (1 + count) * sizeof(zval));
+
+	if (php_http_message_body_stream(obj->body)) {
+		*n = 1;
+		php_stream_to_zval(php_http_message_body_stream(obj->body), obj->gc);
+	} else {
+		*n = 0;
+	}
+
 	if (count) {
 		zval *val;
 
-		obj->gc = erealloc(obj->gc, (*n + count) * sizeof(zval));
-
 		ZEND_HASH_FOREACH_VAL(props, val)
 		{
 			ZVAL_COPY_VALUE(&obj->gc[(*n)++], val);
diff --git a/src/php_http_misc.c b/src/php_http_misc.c
index 36e3490..064598c 100644
--- a/src/php_http_misc.c
+++ b/src/php_http_misc.c
@@ -190,7 +190,7 @@ int php_http_array_apply_append_func(zval *value, int num_args, va_list args, ze
 		if (flags & ARRAY_JOIN_STRINGIFY) {
 			convert_to_string_ex(value);
 		}
-		Z_ADDREF_P(value);
+		Z_TRY_ADDREF_P(value);
 
 		if (data) {
 			if (Z_TYPE_P(data) != IS_ARRAY) {
diff --git a/src/php_http_querystring.c b/src/php_http_querystring.c
index 681d009..96b58a7 100644
--- a/src/php_http_querystring.c
+++ b/src/php_http_querystring.c
@@ -385,8 +385,6 @@ PHP_METHOD(HttpQueryString, getGlobalInstance)
 
 		ZVAL_MAKE_REF(_GET);
 		zend_update_property(php_http_querystring_class_entry, return_value, ZEND_STRL("queryArray"), _GET);
-
-		zend_update_static_property(php_http_querystring_class_entry, ZEND_STRL("instance"), return_value);
 	} else {
 		php_http_throw(unexpected_val, "Could not acquire reference to superglobal GET array", NULL);
 	}
diff --git a/tests/propertyproxy001.phpt b/tests/propertyproxy001.phpt
index 59971e5..88a3543 100644
--- a/tests/propertyproxy001.phpt
+++ b/tests/propertyproxy001.phpt
@@ -8,14 +8,16 @@ include "skipif.inc";
 <?php
 
 class m extends http\Message { 
-    function test() { 
+    function test1() { 
         $this->headers["bykey"] = 1; 
         var_dump($this->headers); 
-
+	}
+	function test2() {
         $h = &$this->headers; 
         $h["by1ref"] = 2; 
         var_dump($this->headers); 
-
+	}
+	function test3() {
         $x = &$this->headers["byXref"];
 
         $h = &$this->headers["by2ref"]; 
@@ -24,7 +26,8 @@ class m extends http\Message {
 
         $x = 2;
         var_dump($this->headers);
-
+	}
+	function test4() {
         $this->headers["bynext"][] = 1;
         $this->headers["bynext"][] = 2;
         $this->headers["bynext"][] = 3;
@@ -33,7 +36,10 @@ class m extends http\Message {
 } 
 
 $m=new m; 
-$m->test(); 
+$m->test1(); 
+$m->test2(); 
+$m->test3(); 
+$m->test4(); 
 echo $m,"\n";
 
 ?>