Partial fix for bug #79029

Author: laruence

ext/xmlwriter/php_xmlwriter.c

@@ -83,13 +83,15 @@ typedef int (*xmlwriter_read_int_t)(xmlTextWriterPtr writer);
 static void xmlwriter_free_resource_ptr(xmlwriter_object *intern)
 {
 	if (intern) {
-		if (intern->ptr) {
-			xmlFreeTextWriter(intern->ptr);
-			intern->ptr = NULL;
-		}
-		if (intern->output) {
-			xmlBufferFree(intern->output);
-			intern->output = NULL;
+		if (EG(active)) {
+			if (intern->ptr) {
+				xmlFreeTextWriter(intern->ptr);
+				intern->ptr = NULL;
+			}
+			if (intern->output) {
+				xmlBufferFree(intern->output);
+				intern->output = NULL;
+			}
 		}
 		efree(intern);
 	}

ext/xmlwriter/tests/bug79029_1.phpt

@@ -0,0 +1,13 @@
+--TEST--
+#79029 (Use After Free's in XMLReader / XMLWriter)
+--SKIPIF--
+<?php if (!extension_loaded("xmlwriter")) print "skip"; ?>
+--FILE--
+<?php
+$x = array( new XMLWriter() );
+$x[0]->openUri("a");
+$x[0]->startComment();
+?>
+okey
+--EXPECT--
+okey