Fix GH-16359 curl write callback crash on FCC usage w/o user function.

close GH-16362

Author: devnexen

NEWS

@@ -14,6 +14,8 @@ PHP                                                                        NEWS
 - Curl:
   . Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if
     curl_multi_add_handle fails). (timwolla)
+  . Fixed bug GH-16359 (crash with curl_setopt* CURLOPT_WRITEFUNCTION
+    without null callback). (David Carlier)
 
 - DOM:
   . Fixed bug GH-16316 (DOMXPath breaks when not initialized properly).

ext/curl/interface.c

@@ -1631,12 +1631,17 @@ static bool php_curl_set_callable_handler(zend_fcall_info_cache *const handler_f
 }
 
 
-#define HANDLE_CURL_OPTION_CALLABLE_PHP_CURL_USER(curl_ptr, constant_no_function, handler_type) \
+#define HANDLE_CURL_OPTION_CALLABLE_PHP_CURL_USER(curl_ptr, constant_no_function, handler_type, default_method) \
 	case constant_no_function##FUNCTION: { \
 		bool result = php_curl_set_callable_handler(&curl_ptr->handlers.handler_type->fcc, zvalue, is_array_config, #constant_no_function "FUNCTION"); \
 		if (!result) { \
+			curl_ptr->handlers.handler_type->method = default_method; \
 			return FAILURE; \
 		} \
+		if (!ZEND_FCC_INITIALIZED(curl_ptr->handlers.handler_type->fcc)) { \
+			curl_ptr->handlers.handler_type->method = default_method; \
+			return SUCCESS; \
+		} \
 		curl_ptr->handlers.handler_type->method = PHP_CURL_USER; \
 		break; \
 	}
@@ -1659,9 +1664,9 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue
 
 	switch (option) {
 		/* Callable options */
-		HANDLE_CURL_OPTION_CALLABLE_PHP_CURL_USER(ch, CURLOPT_WRITE, write);
-		HANDLE_CURL_OPTION_CALLABLE_PHP_CURL_USER(ch, CURLOPT_HEADER, write_header);
-		HANDLE_CURL_OPTION_CALLABLE_PHP_CURL_USER(ch, CURLOPT_READ, read);
+		HANDLE_CURL_OPTION_CALLABLE_PHP_CURL_USER(ch, CURLOPT_WRITE, write, PHP_CURL_STDOUT);
+		HANDLE_CURL_OPTION_CALLABLE_PHP_CURL_USER(ch, CURLOPT_HEADER, write_header, PHP_CURL_IGNORE);
+		HANDLE_CURL_OPTION_CALLABLE_PHP_CURL_USER(ch, CURLOPT_READ, read, PHP_CURL_DIRECT);
 
 		HANDLE_CURL_OPTION_CALLABLE(ch, CURLOPT_PROGRESS, handlers.progress, curl_progress);
 		HANDLE_CURL_OPTION_CALLABLE(ch, CURLOPT_XFERINFO, handlers.xferinfo, curl_xferinfo);

ext/curl/tests/gh16359.phpt

@@ -0,0 +1,16 @@
+--TEST--
+GH-16359 - curl_setopt with CURLOPT_WRITEFUNCTION and no user fn
+--EXTENSIONS--
+curl
+--FILE--
+<?php
+$log_file = tempnam(sys_get_temp_dir(), 'php-curl-CURLOPT_WRITEFUNCTION-trampoline');
+$fp = fopen($log_file, 'w+');
+fwrite($fp, "test");
+$ch = curl_init();
+curl_setopt($ch, CURLOPT_WRITEFUNCTION, null);
+curl_setopt($ch, CURLOPT_URL, 'file://' . $log_file);
+curl_exec($ch);
+?>
+--EXPECT--
+test