From 225af964c0324b2bf14e44c0fad77198b97cc06c Mon Sep 17 00:00:00 2001
From: Michael Wallner <mike@php.net>
Date: Wed, 18 Feb 2015 13:58:31 +0100
Subject: [PATCH] Fixed bug #65593 (Segfault when calling ob_start from output
 buffering callback)

---
 NEWS                       |  2 ++
 main/output.c              | 23 ++++++++++++-----------
 tests/output/bug65593.phpt | 13 +++++++++++++
 3 files changed, 27 insertions(+), 11 deletions(-)
 create mode 100644 tests/output/bug65593.phpt

diff --git a/NEWS b/NEWS
index 079e077fe6a5a..5004990d31e93 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? ??? 2015, PHP 5.5.23
 
 - Core:
+  . Fixed bug #65593 (Segfault when calling ob_start from output buffering 
+    callback). (Mike)
   . Fixed bug #69017 (Fail to push to the empty array with the constant value
     defined in class scope). (Laruence)
   . Added NULL byte protection to exec, system and passthru. (Yasuo)
diff --git a/main/output.c b/main/output.c
index f9b8a68a80740..bb0f6bd680223 100644
--- a/main/output.c
+++ b/main/output.c
@@ -172,21 +172,22 @@ PHPAPI void php_output_deactivate(TSRMLS_D)
 {
 	php_output_handler **handler = NULL;
 
-	php_output_header(TSRMLS_C);
+	if ((OG(flags) & PHP_OUTPUT_ACTIVATED)) {
+		php_output_header(TSRMLS_C);
 
-	OG(flags) ^= PHP_OUTPUT_ACTIVATED;
-	OG(active) = NULL;
-	OG(running) = NULL;
+		OG(flags) ^= PHP_OUTPUT_ACTIVATED;
+		OG(active) = NULL;
+		OG(running) = NULL;
 
-	/* release all output handlers */
-	if (OG(handlers).elements) {
-		while (SUCCESS == zend_stack_top(&OG(handlers), (void *) &handler)) {
-			php_output_handler_free(handler TSRMLS_CC);
-			zend_stack_del_top(&OG(handlers));
+		/* release all output handlers */
+		if (OG(handlers).elements) {
+			while (SUCCESS == zend_stack_top(&OG(handlers), (void *) &handler)) {
+				php_output_handler_free(handler TSRMLS_CC);
+				zend_stack_del_top(&OG(handlers));
+			}
+			zend_stack_destroy(&OG(handlers));
 		}
-		zend_stack_destroy(&OG(handlers));
 	}
-
 }
 /* }}} */
 
diff --git a/tests/output/bug65593.phpt b/tests/output/bug65593.phpt
new file mode 100644
index 0000000000000..336c73e03d787
--- /dev/null
+++ b/tests/output/bug65593.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #65593 (ob_start(function(){ob_start();});)
+--FILE--
+<?php 
+echo "Test\n";
+
+ob_start(function(){ob_start();});
+?>
+===DONE===
+--EXPECT--
+Test
+
+Fatal error: Cannot destroy active lambda function in /home/mike/src/php-5.5/tests/output/bug65593.php on line 4