Fixed bug #61728 (php-fpm SIGSEGV running friendica on nginx)

3 files changed, 47 insertions, 7 deletions

diff --git a/NEWS b/NEWS
index 05cc254c65..2b65382b23 100644
--- a/NEWS
+++ b/NEWS
@@ -17,6 +17,7 @@ PHP                                                                        NEWS
 (merge after 5.3.11 release)
 
 - Core:
+  . Fixed bug #61728 (php-fpm SIGSEGV running friendica on nginx). (Laruence)
   . Fixed bug #61660 (bin2hex(hex2bin($data)) != $data). (Nikita Popov)
   . Fixed bug #61650 (ini parser crashes when using ${xxxx} ini variables
     (without apache2)). (Laruence)
diff --git a/ext/session/tests/bug61728.phpt b/ext/session/tests/bug61728.phpt
new file mode 100644
index 0000000000..30b876ea0c
--- /dev/null
+++ b/ext/session/tests/bug61728.phpt
@@ -0,0 +1,39 @@
+--TEST--
+Bug #61728 (php-fpm SIGSEGV running friendica on nginx)
+--SKIPIF--
+<?php include('skipif.inc'); ?>
+--FILE--
+<?php 
+function output_html($ext) {
+    return strlen($ext);
+}
+
+function open ($save_path, $session_name) { 
+    return true;
+} 
+
+function close() { 
+    return true;
+} 
+
+function read ($id) { 
+} 
+
+function write ($id, $sess_data) { 
+    ob_start("output_html");
+    echo "laruence";
+    ob_end_flush();
+    return true;
+} 
+
+function destroy ($id) { 
+} 
+
+function gc ($maxlifetime) { 
+    return true; 
+} 
+
+session_set_save_handler ("open", "close", "read", "write", "destroy", "gc"); 
+session_start();
+--EXPECTF--
+8
diff --git a/main/main.c b/main/main.c
index 6a04ddbaf1..c34f952433 100644
--- a/main/main.c
+++ b/main/main.c
@@ -1740,22 +1740,22 @@ void php_request_shutdown(void *dummy)
 		}
 	} zend_end_try();
 
-	/* 4. Shutdown output layer (send the set HTTP headers, cleanup output handlers, etc.) */
-	zend_try {
-		php_output_deactivate(TSRMLS_C);
-	} zend_end_try();
-
-	/* 5. Reset max_execution_time (no longer executing php code after response sent) */
+	/* 4. Reset max_execution_time (no longer executing php code after response sent) */
 	zend_try {
 		zend_unset_timeout(TSRMLS_C);
 	} zend_end_try();
 
-	/* 6. Call all extensions RSHUTDOWN functions */
+	/* 5. Call all extensions RSHUTDOWN functions */
 	if (PG(modules_activated)) {
 		zend_deactivate_modules(TSRMLS_C);
 		php_free_shutdown_functions(TSRMLS_C);
 	}
 
+	/* 6. Shutdown output layer (send the set HTTP headers, cleanup output handlers, etc.) */
+	zend_try {
+		php_output_deactivate(TSRMLS_C);
+	} zend_end_try();
+
 	/* 7. Destroy super-globals */
 	zend_try {
 		int i;