Also Fixed #68571 in CGI SAPI, and some cleanup

Author: laruence

NEWS

@@ -2,6 +2,7 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2015, PHP 5.5.22
 
+
 - Date:
   . Fixed bug #45081 (strtotime incorrectly interprets SGT time zone). (Derick)
   . Fixed bug #55407 (Impossible to prototype DateTime::createFromFormat).
@@ -13,6 +14,10 @@ PHP                                                                        NEWS
 - Fileinfo:
   . Fixed bug #68827 (Double free with disabled ZMM). (Joshua Rogers)
 
+- FPM:
+  . Fixed bug #68571 (core dump when webserver close the socket).
+    (redfoxli069 at gmail dot com, Laruence)
+
 - OpenSSL:
   . Fixed bug #55618 (use case-insensitive cert name matching).
     (Daniel Lowrey)

sapi/cgi/cgi_main.c

@@ -730,13 +730,16 @@ static void sapi_cgi_log_message(char *message TSRMLS_DC)
 
 		request = (fcgi_request*) SG(server_context);
 		if (request) {
-			int len = strlen(message);
+			int ret, len = strlen(message);
 			char *buf = malloc(len+2);
 
 			memcpy(buf, message, len);
 			memcpy(buf + len, "\n", sizeof("\n"));
-			fcgi_write(request, FCGI_STDERR, buf, len+1);
+			ret = fcgi_write(request, FCGI_STDERR, buf, len + 1);
 			free(buf);
+			if (ret < 0) {
+				php_handle_aborted_connection();
+			}
 		} else {
 			fprintf(stderr, "%s\n", message);
 		}

sapi/cgi/fastcgi.c

@@ -1321,6 +1321,7 @@ int fcgi_flush(fcgi_request *req, int close)
 
 	if (safe_write(req, req->out_buf, len) != len) {
 		req->keep = 0;
+		req->out_pos = req->out_buf;
 		return 0;
 	}
 

sapi/fpm/fpm/fastcgi.c

@@ -975,7 +975,7 @@ int fcgi_flush(fcgi_request *req, int close)
 
 	if (safe_write(req, req->out_buf, len) != len) {
 		req->keep = 0;
-	        req->out_pos = req->out_buf;
+		req->out_pos = req->out_buf;
 		return 0;
 	}
 

sapi/fpm/fpm/fpm_main.c

@@ -669,15 +669,15 @@ void sapi_cgi_log_fastcgi(int level, char *message, size_t len)
 	 * - the message is not empty
 	 */
 	if (CGIG(fcgi_logging) && request && message && len > 0) {
+		int ret;
 		char *buf = malloc(len + 2);
-		ssize_t ret = 0;
 		memcpy(buf, message, len);
 		memcpy(buf + len, "\n", sizeof("\n"));
-		ret = fcgi_write(request, FCGI_STDERR, buf, len+1);
+		ret = fcgi_write(request, FCGI_STDERR, buf, len + 1);
 		free(buf);
-	        if (ret <= 0) {
-                    php_handle_aborted_connection();
-	        }
+		if (ret < 0) {
+			php_handle_aborted_connection();
+		}
 	}
 }
 /* }}} */

sapi/tests/test006.phpt

@@ -43,7 +43,6 @@ Content-Type: application/octet-stream
 phpinfo();
 ?>
 -----------------------------240723202011929--
-
 --FILE--
 <?php 
 error_reporting(0);