From 7cf7de66661e7e40a63c960f5df17fdeb362cb73 Mon Sep 17 00:00:00 2001
From: Michael Wallner <mike@php.net>
Date: Mon, 19 Jan 2015 11:52:40 +0100
Subject: [PATCH] fix arg by ref handling

---
 php_http_encoding.c       | 1 +
 php_http_env.c            | 6 +++++-
 php_http_header.c         | 1 +
 php_http_message.c        | 1 +
 php_http_message_parser.c | 4 ++++
 php_http_negotiate.c      | 1 +
 6 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/php_http_encoding.c b/php_http_encoding.c
index 30b4c81..ad08ff5 100644
--- a/php_http_encoding.c
+++ b/php_http_encoding.c
@@ -1146,6 +1146,7 @@ static PHP_METHOD(HttpDechunkStream, decode)
 
 		if ((end_ptr = php_http_encoding_dechunk(str, len, &enc_str, &enc_len))) {
 			if (zlen) {
+				ZVAL_DEREF(zlen);
 				zval_dtor(zlen);
 				ZVAL_LONG(zlen, str + len - end_ptr);
 			}
diff --git a/php_http_env.c b/php_http_env.c
index 239af98..4c74966 100644
--- a/php_http_env.c
+++ b/php_http_env.c
@@ -813,6 +813,7 @@ static PHP_METHOD(HttpEnv, negotiateLanguage)
 		return;
 	}
 	if (rs_array) {
+		ZVAL_DEREF(rs_array);
 		zval_dtor(rs_array);
 		array_init(rs_array);
 	}
@@ -833,6 +834,7 @@ static PHP_METHOD(HttpEnv, negotiateCharset)
 		return;
 	}
 	if (rs_array) {
+		ZVAL_DEREF(rs_array);
 		zval_dtor(rs_array);
 		array_init(rs_array);
 	}
@@ -852,6 +854,7 @@ static PHP_METHOD(HttpEnv, negotiateEncoding)
 		return;
 	}
 	if (rs_array) {
+		ZVAL_DEREF(rs_array);
 		zval_dtor(rs_array);
 		array_init(rs_array);
 	}
@@ -871,6 +874,7 @@ static PHP_METHOD(HttpEnv, negotiateContentType)
 		return;
 	}
 	if (rs_array) {
+		ZVAL_DEREF(rs_array);
 		zval_dtor(rs_array);
 		array_init(rs_array);
 	}
@@ -894,8 +898,8 @@ static PHP_METHOD(HttpEnv, negotiate)
 		return;
 	}
 
-
 	if (rs_array) {
+		ZVAL_DEREF(rs_array);
 		zval_dtor(rs_array);
 		array_init(rs_array);
 	}
diff --git a/php_http_header.c b/php_http_header.c
index dfcba3c..6d47d99 100644
--- a/php_http_header.c
+++ b/php_http_header.c
@@ -243,6 +243,7 @@ PHP_METHOD(HttpHeader, negotiate)
 		return;
 	}
 	if (rs_array) {
+		ZVAL_DEREF(rs_array);
 		zval_dtor(rs_array);
 		array_init(rs_array);
 	}
diff --git a/php_http_message.c b/php_http_message.c
index 0c5b1b9..ff228c7 100644
--- a/php_http_message.c
+++ b/php_http_message.c
@@ -1771,6 +1771,7 @@ static PHP_METHOD(HttpMessage, isMultipart)
 		}
 
 		if (zboundary && boundary) {
+			ZVAL_DEREF(zboundary);
 			zval_dtor(zboundary);
 			ZVAL_STR(zboundary, php_http_cs2zs(boundary, strlen(boundary)));
 		}
diff --git a/php_http_message_parser.c b/php_http_message_parser.c
index 2438fc1..eec4433 100644
--- a/php_http_message_parser.c
+++ b/php_http_message_parser.c
@@ -578,7 +578,9 @@ static PHP_METHOD(HttpMessageParser, parse)
 	php_http_buffer_append(&parser_obj->buffer, data_str, data_len);
 	RETVAL_LONG(php_http_message_parser_parse(parser_obj->parser, &parser_obj->buffer, flags, &parser_obj->parser->message));
 
+	ZVAL_DEREF(zmsg);
 	zval_dtor(zmsg);
+	ZVAL_NULL(zmsg);
 	if (parser_obj->parser->message) {
 		php_http_message_t *msg_cpy = php_http_message_copy(parser_obj->parser->message, NULL);
 		php_http_message_object_t *msg_obj = php_http_message_object_new_ex(php_http_message_class_entry, msg_cpy);
@@ -608,7 +610,9 @@ static PHP_METHOD(HttpMessageParser, stream)
 	parser_obj = PHP_HTTP_OBJ(NULL, getThis());
 	RETVAL_LONG(php_http_message_parser_parse_stream(parser_obj->parser, &parser_obj->buffer, s, flags, &parser_obj->parser->message));
 
+	ZVAL_DEREF(zmsg);
 	zval_dtor(zmsg);
+	ZVAL_NULL(zmsg);
 	if (parser_obj->parser->message) {
 		php_http_message_t *msg_cpy = php_http_message_copy(parser_obj->parser->message, NULL);
 		php_http_message_object_t *msg_obj = php_http_message_object_new_ex(php_http_message_class_entry, msg_cpy);
diff --git a/php_http_negotiate.c b/php_http_negotiate.c
index 1535b86..ede406f 100644
--- a/php_http_negotiate.c
+++ b/php_http_negotiate.c
@@ -92,6 +92,7 @@ static int php_http_negotiate_reduce(zval *p, int num_args, va_list args, zend_h
 	ZEND_HASH_FOREACH_END();
 
 	if (q && Z_DVAL_P(q) > 0) {
+		Z_TRY_ADDREF_P(q);
 		zend_hash_update(result, supported, q);
 	}
 
-- 
2.30.2