Fixed bug #65593 (Segfault when calling ob_start from output buffering callback)

Author: m6w6

NEWS

@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? ??? 2015, PHP 5.5.23
 
 - Core:
+  . Fixed bug #65593 (Segfault when calling ob_start from output buffering 
+    callback). (Mike)
   . Fixed bug #69017 (Fail to push to the empty array with the constant value
     defined in class scope). (Laruence)
   . Added NULL byte protection to exec, system and passthru. (Yasuo)

main/output.c

@@ -172,21 +172,22 @@ PHPAPI void php_output_deactivate(TSRMLS_D)
 {
 	php_output_handler **handler = NULL;
 
-	php_output_header(TSRMLS_C);
+	if ((OG(flags) & PHP_OUTPUT_ACTIVATED)) {
+		php_output_header(TSRMLS_C);
 
-	OG(flags) ^= PHP_OUTPUT_ACTIVATED;
-	OG(active) = NULL;
-	OG(running) = NULL;
+		OG(flags) ^= PHP_OUTPUT_ACTIVATED;
+		OG(active) = NULL;
+		OG(running) = NULL;
 
-	/* release all output handlers */
-	if (OG(handlers).elements) {
-		while (SUCCESS == zend_stack_top(&OG(handlers), (void *) &handler)) {
-			php_output_handler_free(handler TSRMLS_CC);
-			zend_stack_del_top(&OG(handlers));
+		/* release all output handlers */
+		if (OG(handlers).elements) {
+			while (SUCCESS == zend_stack_top(&OG(handlers), (void *) &handler)) {
+				php_output_handler_free(handler TSRMLS_CC);
+				zend_stack_del_top(&OG(handlers));
+			}
+			zend_stack_destroy(&OG(handlers));
 		}
-		zend_stack_destroy(&OG(handlers));
 	}
-
 }
 /* }}} */
 

tests/output/bug65593.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #65593 (ob_start(function(){ob_start();});)
+--FILE--
+<?php 
+echo "Test\n";
+
+ob_start(function(){ob_start();});
+?>
+===DONE===
+--EXPECT--
+Test
+
+Fatal error: Cannot destroy active lambda function in /home/mike/src/php-5.5/tests/output/bug65593.php on line 4