Fix bug #67644 - Memory corruption & crash during ob_start function callback

12 years ago · 53fa6c5b6b
2 changed files with 8 additions and 0 deletions
--- a/2
+++ b/2
@ -6,6 +6,8 @@ PHP                                                                        NEWS
  . Fixed bug #47358 (glob returns error, should be empty array()). (Pierre)
  . Fixed bug #65463 (SIGSEGV during zend_shutdown()). (Keyur Govande)
  . Fixed bug #66036 (Crash on SIGTERM in apache process). (Keyur Govande)
+  . Fixed bug #67644 (Memory corruption & crash during ob_start function
+    callback). (Stas)

 - OpenSSL:
  . Fixed bug #41631 (socket timeouts not honored in blocking SSL reads).
--- a/main/main.c
+++ b/main/main.c
@ -1767,6 +1767,12 @@ void php_request_shutdown(void *dummy)
 		}
 	} zend_end_try();

+	/* Output buffer handlers may have created new objects. Mark these objects
+           as destructed to avoid calling their dtors too late on shutdown when
+           all dtors were supposed to be cleaned
+        */
+	zend_objects_store_mark_destructed(&EG(objects_store) TSRMLS_CC);
+
 	/* 4. Reset max_execution_time (no longer executing php code after response sent) */
 	zend_try {
 		zend_unset_timeout(TSRMLS_C);