Fix a major thread safety bug in the output mechanism

@- Fixed a major memory corruption bug in the thread safe version (Zeev)

6 files changed, 27 insertions, 17 deletions

diff --git a/ext/standard/output.c b/ext/standard/output.c
index cacf045a0c..c29ef41900 100644
--- a/ext/standard/output.c
+++ b/ext/standard/output.c
@@ -61,22 +61,24 @@ static void php_output_init_globals(OLS_D)
 
 
 /* Start output layer */
-PHPAPI void php_output_startup()
+PHPAPI void php_output_startup(void)
 {
 #ifdef ZTS
 	output_globals_id = ts_allocate_id(sizeof(php_output_globals), (ts_allocate_ctor) php_output_init_globals, NULL);
 #else 
 	php_output_init_globals(OLS_C);
 #endif
+}
 
-	{
-		OLS_FETCH();
 
-		OG(php_body_write) = php_ub_body_write;
-		OG(php_header_write) = sapi_module.ub_write;
-		OG(nesting_level) = 0;
-		OG(lock) = 0;
-	}
+PHPAPI void php_output_activate(void)
+{
+	OLS_FETCH();
+
+	OG(php_body_write) = php_ub_body_write;
+	OG(php_header_write) = sapi_module.ub_write;
+	OG(nesting_level) = 0;
+	OG(lock) = 0;
 }
 
 
diff --git a/ext/standard/php_output.h b/ext/standard/php_output.h
index 58a3db8c15..2d06f5ce34 100644
--- a/ext/standard/php_output.h
+++ b/ext/standard/php_output.h
@@ -26,6 +26,7 @@
 typedef void (*php_output_handler_func_t)(char *output, uint output_len, char **handled_output, uint *handled_output_len, int mode);
 
 PHPAPI void php_output_startup(void);
+PHPAPI void php_output_activate(void);
 void php_output_register_constants(void);
 PHPAPI int  php_body_write(const char *str, uint str_length);
 PHPAPI int  php_header_write(const char *str, uint str_length);
diff --git a/main/main.c b/main/main.c
index 73d2bc9889..eecf8e1a9c 100644
--- a/main/main.c
+++ b/main/main.c
@@ -613,7 +613,7 @@ int php_request_startup(CLS_D ELS_DC PLS_DC SLS_DC)
 
 	PG(during_request_startup) = 1;
 	
-	php_output_startup();
+	php_output_activate();
 
 	/* initialize global variables */
 	PG(modules_activated) = 0;
@@ -829,6 +829,7 @@ int php_module_startup(sapi_module_struct *sf)
 	sapi_module = *sf;
 
 	php_output_startup();
+	php_output_activate();
 
 	zuf.error_function = php_error_cb;
 	zuf.printf_function = php_printf;
diff --git a/main/output.c b/main/output.c
index cacf045a0c..c29ef41900 100644
--- a/main/output.c
+++ b/main/output.c
@@ -61,22 +61,24 @@ static void php_output_init_globals(OLS_D)
 
 
 /* Start output layer */
-PHPAPI void php_output_startup()
+PHPAPI void php_output_startup(void)
 {
 #ifdef ZTS
 	output_globals_id = ts_allocate_id(sizeof(php_output_globals), (ts_allocate_ctor) php_output_init_globals, NULL);
 #else 
 	php_output_init_globals(OLS_C);
 #endif
+}
 
-	{
-		OLS_FETCH();
 
-		OG(php_body_write) = php_ub_body_write;
-		OG(php_header_write) = sapi_module.ub_write;
-		OG(nesting_level) = 0;
-		OG(lock) = 0;
-	}
+PHPAPI void php_output_activate(void)
+{
+	OLS_FETCH();
+
+	OG(php_body_write) = php_ub_body_write;
+	OG(php_header_write) = sapi_module.ub_write;
+	OG(nesting_level) = 0;
+	OG(lock) = 0;
 }
 
 
diff --git a/main/php_output.h b/main/php_output.h
index 58a3db8c15..2d06f5ce34 100644
--- a/main/php_output.h
+++ b/main/php_output.h
@@ -26,6 +26,7 @@
 typedef void (*php_output_handler_func_t)(char *output, uint output_len, char **handled_output, uint *handled_output_len, int mode);
 
 PHPAPI void php_output_startup(void);
+PHPAPI void php_output_activate(void);
 void php_output_register_constants(void);
 PHPAPI int  php_body_write(const char *str, uint str_length);
 PHPAPI int  php_header_write(const char *str, uint str_length);
diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c
index bd1ae85873..151d33a979 100644
--- a/sapi/cgi/cgi_main.c
+++ b/sapi/cgi/cgi_main.c
@@ -502,6 +502,7 @@ any .htaccess restrictions anywhere on your site you can leave doc_root undefine
 				case '?':
 					no_headers = 1;
 					php_output_startup();
+					php_output_activate();
 					SG(headers_sent) = 1;
 					php_cgi_usage(argv[0]);
 					php_end_ob_buffers(1);
@@ -566,6 +567,7 @@ any .htaccess restrictions anywhere on your site you can leave doc_root undefine
 				case '?':
 					no_headers = 1;  
 					php_output_startup();
+					php_output_activate();
 					SG(headers_sent) = 1;
 					php_cgi_usage(argv[0]);
 					php_end_ob_buffers(1);
@@ -592,6 +594,7 @@ any .htaccess restrictions anywhere on your site you can leave doc_root undefine
 
 			case 'm': /* list compiled in modules */
 		        php_output_startup();
+				php_output_activate();
                 SG(headers_sent) = 1;
 				php_printf("Running PHP %s\n%s\n", PHP_VERSION , get_zend_version());
 				php_printf("[PHP Modules]\n");