Merge branch 'PHP-7.4'

* PHP-7.4:
  Fix #79191: Error in SoapClient ctor disables DOMDocument::save()

5 files changed, 66 insertions, 12 deletions

diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
index 01dc753c7e..edc2020f46 100644
--- a/ext/libxml/libxml.c
+++ b/ext/libxml/libxml.c
@@ -354,9 +354,6 @@ static int php_libxml_streams_IO_read(void *context, char *buffer, int len)
 
 static int php_libxml_streams_IO_write(void *context, const char *buffer, int len)
 {
-	if (CG(unclean_shutdown)) {
-		return -1;
-	}
 	return php_stream_write((php_stream*)context, buffer, len);
 }
 
diff --git a/ext/libxml/tests/bug79191.phpt b/ext/libxml/tests/bug79191.phpt
new file mode 100644
index 0000000000..7d0dc83f23
--- /dev/null
+++ b/ext/libxml/tests/bug79191.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #79191 (Error in SoapClient ctor disables DOMDocument::save())
+--SKIPIF--
+<?php
+if (!extension_loaded('soap')) die('skip soap extension not available');
+if (!extension_loaded('dom')) die('dom extension not available');
+?>
+--FILE--
+<?php
+try {
+    new \SoapClient('does-not-exist.wsdl');
+} catch (Throwable $t) {
+}
+
+$dom = new DOMDocument;
+$dom->loadxml('<?xml version="1.0" ?><root />');
+var_dump($dom->save(__DIR__ . '/bug79191.xml'));
+?>
+--CLEAN--
+<?php
+unlink(__DIR__ . '/bug79191.xml');
+?>
+--EXPECTF--
+int(%d)
diff --git a/ext/xmlwriter/php_xmlwriter.c b/ext/xmlwriter/php_xmlwriter.c
index fc1eb822d0..a2e3acacaf 100644
--- a/ext/xmlwriter/php_xmlwriter.c
+++ b/ext/xmlwriter/php_xmlwriter.c
@@ -89,13 +89,12 @@ typedef int (*xmlwriter_read_int_t)(xmlTextWriterPtr writer);
 
 static zend_object_handlers xmlwriter_object_handlers;
 
-/* {{{ xmlwriter_object_free_storage */
-static void xmlwriter_object_free_storage(zend_object *object)
+/* {{{{ xmlwriter_object_dtor */
+static void xmlwriter_object_dtor(zend_object *object)
 {
 	ze_xmlwriter_object *intern = php_xmlwriter_fetch_object(object);
-	if (!intern) {
-		return;
-	}
+
+	/* freeing the resource here may leak, but otherwise we may use it after it has been freed */
 	if (intern->ptr) {
 		xmlFreeTextWriter(intern->ptr);
 		intern->ptr = NULL;
@@ -104,6 +103,15 @@ static void xmlwriter_object_free_storage(zend_object *object)
 		xmlBufferFree(intern->output);
 		intern->output = NULL;
 	}
+	zend_objects_destroy_object(object);
+}
+/* }}} */
+
+/* {{{ xmlwriter_object_free_storage */
+static void xmlwriter_object_free_storage(zend_object *object)
+{
+	ze_xmlwriter_object *intern = php_xmlwriter_fetch_object(object);
+
 	zend_object_std_dtor(&intern->std);
 }
 /* }}} */
@@ -1211,6 +1219,7 @@ static PHP_MINIT_FUNCTION(xmlwriter)
 
 	memcpy(&xmlwriter_object_handlers, &std_object_handlers, sizeof(zend_object_handlers));
 	xmlwriter_object_handlers.offset = XtOffsetOf(ze_xmlwriter_object, std);
+	xmlwriter_object_handlers.dtor_obj = xmlwriter_object_dtor;
 	xmlwriter_object_handlers.free_obj = xmlwriter_object_free_storage;
 	xmlwriter_object_handlers.clone_obj = NULL;
 	INIT_CLASS_ENTRY(ce, "XMLWriter", xmlwriter_class_functions);
diff --git a/ext/xmlwriter/tests/bug71536.phpt b/ext/xmlwriter/tests/bug71536.phpt
new file mode 100644
index 0000000000..4ce2f2e404
--- /dev/null
+++ b/ext/xmlwriter/tests/bug71536.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #71536 (Access Violation crashes php-cgi.exe)
+--SKIPIF--
+<?php
+if (!extension_loaded('xmlwriter')) die('skip xmlwriter extension not available');
+?>
+--FILE--
+<?php
+class Test {
+    public static function init()
+    {
+        $xml = new \XMLWriter();
+        $xml->openUri('php://memory');
+        $xml->setIndent(false);
+        $xml->startDocument('1.0', 'UTF-8');
+        $xml->startElement('response');
+        die('now'); // crashed with die()
+    }
+}
+
+Test::init();
+?>
+--EXPECT--
+now
diff --git a/ext/xmlwriter/tests/bug79029.phpt b/ext/xmlwriter/tests/bug79029.phpt
index 2e76a4e409..b6b0c84b18 100644
--- a/ext/xmlwriter/tests/bug79029.phpt
+++ b/ext/xmlwriter/tests/bug79029.phpt
@@ -11,13 +11,13 @@ $x = array( new XMLWriter() );
 $x[0]->openUri("bug79029_1.txt");
 $x[0]->startComment();
 
-$x = new XMLWriter();
-$x->openUri("bug79029_2.txt");
+$y = new XMLWriter();
+$y->openUri("bug79029_2.txt");
 fclose(@end(get_resources()));
 
 file_put_contents("bug79029_3.txt", "a");
-$x = new XMLReader();
-$x->open("bug79029_3.txt");
+$z = new XMLReader();
+$z->open("bug79029_3.txt");
 fclose(@end(get_resources()));
 ?>
 okey