af9dc8
From 3c3ff434329d2f505b00a79bacfdef95ca96f0d2 Mon Sep 17 00:00:00 2001
af9dc8
From: krakjoe <joe.watkins@live.co.uk>
af9dc8
Date: Wed, 1 Jan 2014 12:58:18 +0000
af9dc8
Subject: [PATCH] fix #66375 bad logic in sapi header callback routine
af9dc8
af9dc8
---
af9dc8
 main/SAPI.c | 43 +++++++++++++++++++++++++------------------
af9dc8
 1 file changed, 25 insertions(+), 18 deletions(-)
af9dc8
af9dc8
diff --git a/main/SAPI.c b/main/SAPI.c
af9dc8
index dcb2da6..9ffc258 100644
af9dc8
--- a/main/SAPI.c
af9dc8
+++ b/main/SAPI.c
af9dc8
@@ -137,6 +137,7 @@ PHP_FUNCTION(header_register_callback)
af9dc8
 		efree(callback_name);
af9dc8
 		RETURN_FALSE;
af9dc8
 	}
af9dc8
+
af9dc8
 	efree(callback_name);
af9dc8
 
af9dc8
 	if (SG(callback_func)) {
af9dc8
@@ -144,10 +145,10 @@ PHP_FUNCTION(header_register_callback)
af9dc8
 		SG(fci_cache) = empty_fcall_info_cache;
af9dc8
 	}
af9dc8
 
af9dc8
-	Z_ADDREF_P(callback_func);
af9dc8
-
af9dc8
 	SG(callback_func) = callback_func;
af9dc8
-	
af9dc8
+
af9dc8
+	Z_ADDREF_P(SG(callback_func));
af9dc8
+
af9dc8
 	RETURN_TRUE;
af9dc8
 }
af9dc8
 /* }}} */
af9dc8
@@ -156,24 +157,30 @@ static void sapi_run_header_callback(TSRMLS_D)
af9dc8
 {
af9dc8
 	int   error;
af9dc8
 	zend_fcall_info fci;
af9dc8
+	char *callback_name = NULL;
af9dc8
+	char *callback_error = NULL;
af9dc8
 	zval *retval_ptr = NULL;
af9dc8
-
af9dc8
-	fci.size = sizeof(fci);
af9dc8
-	fci.function_table = EG(function_table);
af9dc8
-	fci.object_ptr = NULL;
af9dc8
-	fci.function_name = SG(callback_func);
af9dc8
-	fci.retval_ptr_ptr = &retval_ptr;
af9dc8
-	fci.param_count = 0;
af9dc8
-	fci.params = NULL;
af9dc8
-	fci.no_separation = 0;
af9dc8
-	fci.symbol_table = NULL;
af9dc8
-
af9dc8
-	error = zend_call_function(&fci, &SG(fci_cache) TSRMLS_CC);
af9dc8
-	if (error == FAILURE) {
af9dc8
+	
af9dc8
+	if (zend_fcall_info_init(SG(callback_func), 0, &fci, &SG(fci_cache), &callback_name, &callback_error TSRMLS_CC) == SUCCESS) {
af9dc8
+		fci.retval_ptr_ptr = &retval_ptr;
af9dc8
+		
af9dc8
+		error = zend_call_function(&fci, &SG(fci_cache) TSRMLS_CC);
af9dc8
+		if (error == FAILURE) {
af9dc8
+			goto callback_failed;
af9dc8
+		} else if (retval_ptr) {
af9dc8
+			zval_ptr_dtor(&retval_ptr);
af9dc8
+		}
af9dc8
+	} else {
af9dc8
+callback_failed:
af9dc8
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the sapi_header_callback");
af9dc8
-	} else if (retval_ptr) {
af9dc8
-		zval_ptr_dtor(&retval_ptr);
af9dc8
 	}
af9dc8
+	
af9dc8
+	if (callback_name) {
af9dc8
+		efree(callback_name);
af9dc8
+	}
af9dc8
+	if (callback_error) {
af9dc8
+		efree(callback_error);
af9dc8
+	}	
af9dc8
 }
af9dc8
 
af9dc8
 SAPI_API void sapi_handle_post(void *arg TSRMLS_DC)
af9dc8
-- 
af9dc8
2.1.4
af9dc8