Fixed bug #72284 (phpdbg fatal errors with coverage)

Cherry-pick of original commits d3371b and 0f20e11 only present in master
lidawei · May 30, 2016 · 67468fb · 67468fb
1 parent 933d6b1
commit 67468fb
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 3 deletions.
diff --git a/NEWS b/NEWS
@@ -17,6 +17,9 @@ PHP                                                                        NEWS
   . Fixed bug #71573 (Segfault (core dumped) if paramno beyond bound).
     (Laruence)
 
+- Phpdbg:
+  . Fixed bug #72284 (phpdbg fatal errors with coverage). (Bob)
+
 - Postgres:
   . Fixed bug #72195 (pg_pconnect/pg_connect cause use-after-free). (Laruence)
   . Fixed bug #72197 (pg_lo_create arbitrary read). (Anatol)

diff --git a/sapi/phpdbg/phpdbg_list.c b/sapi/phpdbg/phpdbg_list.c
@@ -232,6 +232,7 @@ void phpdbg_list_function_byname(const char *str, size_t len) /* {{{ */
 	efree(func_name);
 } /* }}} */
 
+/* Note: do not free the original file handler, let original compile_file() or caller do that. Caller may rely on its value to check success */
 zend_op_array *phpdbg_compile_file(zend_file_handle *file, int type) {
 	phpdbg_file_source data, *dataptr;
 	zend_file_handle fake;
@@ -242,8 +243,7 @@ zend_op_array *phpdbg_compile_file(zend_file_handle *file, int type) {
 	char resolved_path_buf[MAXPATHLEN];
 
 	if (zend_stream_fixup(file, &bufptr, &data.len) == FAILURE) {
-		zend_file_handle_dtor(file);
-		return NULL;
+		return PHPDBG_G(compile_file)(file, type);
 	}
 
 	data.buf = emalloc(data.len + ZEND_MMAP_AHEAD + 1);
@@ -280,6 +280,10 @@ zend_op_array *phpdbg_compile_file(zend_file_handle *file, int type) {
 	if (ret == NULL) {
 		efree(data.buf);
 		efree(dataptr);
+
+		fake.opened_path = NULL;
+		zend_file_handle_dtor(&fake);
+
 		return NULL;
 	}
 
@@ -289,7 +293,6 @@ zend_op_array *phpdbg_compile_file(zend_file_handle *file, int type) {
 
 	fake.opened_path = NULL;
 	zend_file_handle_dtor(&fake);
-	zend_file_handle_dtor(file);
 
 	return ret;
 }