- Fixed bug #27183 (Userland stream wrapper segfaults on stream_write)

Was applied to PHP 4 ages ago, but not to PHP 5 branch

NEWS

@@ -54,6 +54,7 @@ PHP                                                                        NEWS
 - Fixed bug #29061 (soap extension segfaults). (Dmitry)
 - Fixed bug #28985 (__getTypes() returning nothing on complex WSDL). (Dmitry)
 - Fixed bug #28969 (Wrong data encoding of special characters). (Dmitry)
+- Fixed bug #27183 (Userland stream wrapper segfaults on stream_write). (Christian)
 
 13 Jul 2004, PHP 5.0.0
 - Rewritten UNIX and Windows install help files. (Documentation Team)

main/streams/userspace.c

@@ -501,15 +501,15 @@ static size_t php_userstreamop_write(php_stream *stream, const char *buf, size_t
 	int call_result;
 	php_userstream_data_t *us = (php_userstream_data_t *)stream->abstract;
 	zval **args[1];
-	zval zbuff, *zbufptr;
+	zval *zbufptr;
 	size_t didwrite = 0;
 
 	assert(us != NULL);
 
 	ZVAL_STRINGL(&func_name, USERSTREAM_WRITE, sizeof(USERSTREAM_WRITE)-1, 0);
 
-	ZVAL_STRINGL(&zbuff, (char*)buf, count, 0);
-	zbufptr = &zbuff;
+	MAKE_STD_ZVAL(zbufptr);
+	ZVAL_STRINGL(zbufptr, (char*)buf, count, 1);;
 	args[0] = &zbufptr;
 
 	call_result = call_user_function_ex(NULL,
@@ -518,6 +518,7 @@ static size_t php_userstreamop_write(php_stream *stream, const char *buf, size_t
 			&retval,
 			1, args,
 			0, NULL TSRMLS_CC);
+	zval_ptr_dtor(&zbufptr);
 
 	didwrite = 0;
 	if (call_result == SUCCESS && retval != NULL) {