Fixed bug #35316 (Application exception trying to create COM object)

Fix some handler signatures causing memory corruption
Various unicode fixes

ext/com_dotnet/com_handlers.c

@@ -486,17 +486,13 @@ static int com_objects_compare(zval *object1, zval *object2 TSRMLS_DC)
 	return ret;
 }
 
-static int com_object_cast(zval *readobj, zval *writeobj, int type, int should_free TSRMLS_DC)
+static int com_object_cast(zval *readobj, zval *writeobj, int type TSRMLS_DC)
 {
 	php_com_dotnet_object *obj;
 	VARIANT v;
 	VARTYPE vt = VT_EMPTY;
 	zval free_obj;
 	HRESULT res = S_OK;
-	
-	if (should_free) {
-		free_obj = *writeobj;
-	}
 
 	obj = CDNO_FETCH(readobj);
 	ZVAL_NULL(writeobj);
@@ -539,10 +535,6 @@ static int com_object_cast(zval *readobj, zval *writeobj, int type, int should_f
 
 	VariantClear(&v);
 
-	if (should_free) {
-		zval_dtor(&free_obj);
-	}
-
 	if (SUCCEEDED(res)) {
 		return SUCCESS;
 	}
@@ -678,6 +670,7 @@ zend_object_value php_com_object_new(zend_class_entry *ce TSRMLS_DC)
 	VariantInit(&obj->v);
 	obj->code_page = CP_ACP;
 	obj->ce = ce;
+	obj->zo.ce = ce;
 
 	retval.handle = zend_objects_store_put(obj, NULL, php_com_object_free_storage, php_com_object_clone TSRMLS_CC);
 	retval.handlers = &php_com_object_handlers;

ext/com_dotnet/com_misc.c

@@ -36,7 +36,7 @@ void php_com_throw_exception(HRESULT code, char *message TSRMLS_DC)
 		message = php_win_err(code);
 		free_msg = 1;
 	}
-	zend_throw_exception(php_com_exception_class_entry, message, (long)code TSRMLS_CC);
+	zend_throw_exception(U_CLASS_ENTRY(php_com_exception_class_entry), message, (long)code TSRMLS_CC);
 	if (free_msg) {
 		LocalFree(message);
 	}
@@ -51,6 +51,7 @@ PHPAPI void php_com_wrap_dispatch(zval *z, IDispatch *disp,
 	memset(obj, 0, sizeof(*obj));
 	obj->code_page = codepage;
 	obj->ce = php_com_variant_class_entry;
+	obj->zo.ce = php_com_variant_class_entry;
 
 	VariantInit(&obj->v);
 	V_VT(&obj->v) = VT_DISPATCH;
@@ -73,6 +74,7 @@ PHPAPI void php_com_wrap_variant(zval *z, VARIANT *v,
 	memset(obj, 0, sizeof(*obj));
 	obj->code_page = codepage;
 	obj->ce = php_com_variant_class_entry;
+	obj->zo.ce = php_com_variant_class_entry;
 
 	VariantInit(&obj->v);
 	VariantCopyInd(&obj->v, v);

ext/com_dotnet/com_saproxy.c

@@ -323,7 +323,7 @@ static HashTable *saproxy_properties_get(zval *object TSRMLS_DC)
 	return NULL;
 }
 
-static union _zend_function *saproxy_method_get(zval *object, char *name, int len TSRMLS_DC)
+static union _zend_function *saproxy_method_get(zval **object, char *name, int len TSRMLS_DC)
 {
 	/* no methods */
 	return NULL;
@@ -357,7 +357,7 @@ static int saproxy_objects_compare(zval *object1, zval *object2 TSRMLS_DC)
 	return -1;
 }
 
-static int saproxy_object_cast(zval *readobj, zval *writeobj, int type, int should_free TSRMLS_DC)
+static int saproxy_object_cast(zval *readobj, zval *writeobj, int type TSRMLS_DC)
 {
 	return FAILURE;
 }

ext/com_dotnet/com_variant.c

@@ -217,7 +217,13 @@ PHPAPI int php_com_zval_from_variant(zval *z, VARIANT *v, int codepage TSRMLS_DC
 			break;
 		case VT_BSTR:
 			if (V_BSTR(v)) {
-				ZVAL_UNICODE(z, V_BSTR(v), 1);
+				if (UG(unicode)) {
+					ZVAL_UNICODE(z, V_BSTR(v), 1);
+				} else {
+					Z_TYPE_P(z) = IS_STRING;
+					Z_STRVAL_P(z) = php_com_olestring_to_string(V_BSTR(v),
+						&Z_STRLEN_P(z), codepage TSRMLS_CC);
+				}
 			}
 			break;
 		case VT_UNKNOWN:

ext/com_dotnet/php_com_dotnet_internal.h

@@ -33,6 +33,8 @@
 #undef php_win_err
 
 typedef struct _php_com_dotnet_object {
+	zend_object zo;
+
 	VARIANT v;
 
 	ITypeInfo *typeinfo;