diff --git a/NEWS b/NEWS index 9aa71bd3486b5..6ad57201b2f95 100644 --- a/NEWS +++ b/NEWS @@ -17,6 +17,9 @@ PHP NEWS . Fixed bug #71573 (Segfault (core dumped) if paramno beyond bound). (Laruence) +- Phpdbg: + . Fixed bug #72284 (phpdbg fatal errors with coverage). (Bob) + - Postgres: . Fixed bug #72195 (pg_pconnect/pg_connect cause use-after-free). (Laruence) . Fixed bug #72197 (pg_lo_create arbitrary read). (Anatol) diff --git a/sapi/phpdbg/phpdbg_list.c b/sapi/phpdbg/phpdbg_list.c index e9cf1bc0b8618..6895bea43ef37 100644 --- a/sapi/phpdbg/phpdbg_list.c +++ b/sapi/phpdbg/phpdbg_list.c @@ -232,6 +232,7 @@ void phpdbg_list_function_byname(const char *str, size_t len) /* {{{ */ efree(func_name); } /* }}} */ +/* Note: do not free the original file handler, let original compile_file() or caller do that. Caller may rely on its value to check success */ zend_op_array *phpdbg_compile_file(zend_file_handle *file, int type) { phpdbg_file_source data, *dataptr; zend_file_handle fake; @@ -242,8 +243,7 @@ zend_op_array *phpdbg_compile_file(zend_file_handle *file, int type) { char resolved_path_buf[MAXPATHLEN]; if (zend_stream_fixup(file, &bufptr, &data.len) == FAILURE) { - zend_file_handle_dtor(file); - return NULL; + return PHPDBG_G(compile_file)(file, type); } data.buf = emalloc(data.len + ZEND_MMAP_AHEAD + 1); @@ -280,6 +280,10 @@ zend_op_array *phpdbg_compile_file(zend_file_handle *file, int type) { if (ret == NULL) { efree(data.buf); efree(dataptr); + + fake.opened_path = NULL; + zend_file_handle_dtor(&fake); + return NULL; } @@ -289,7 +293,6 @@ zend_op_array *phpdbg_compile_file(zend_file_handle *file, int type) { fake.opened_path = NULL; zend_file_handle_dtor(&fake); - zend_file_handle_dtor(file); return ret; }