Fixed bug #62839

curl_copy_handle segfault with CURLOPT_FILE. The refcount was incremented
before the assignement.

2 files changed, 20 insertions, 2 deletions

diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index 94be60fd5d..7b72873038 100644
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -1610,9 +1610,9 @@ PHP_FUNCTION(curl_copy_handle)
 	dupch->uses = 0;
 	ch->uses++;
 	if (ch->handlers->write->stream) {
-		Z_ADDREF_P(dupch->handlers->write->stream);
-		dupch->handlers->write->stream = ch->handlers->write->stream;
+		Z_ADDREF_P(ch->handlers->write->stream);
 	}
+	dupch->handlers->write->stream = ch->handlers->write->stream;
 	dupch->handlers->write->method = ch->handlers->write->method;
 	dupch->handlers->write->type   = ch->handlers->write->type;
 	if (ch->handlers->read->stream) {
diff --git a/ext/curl/tests/bug62839.phpt b/ext/curl/tests/bug62839.phpt
new file mode 100644
index 0000000000..39e6fc9cbe
--- /dev/null
+++ b/ext/curl/tests/bug62839.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #62839 (curl_copy_handle segfault with CURLOPT_FILE)
+--SKIPIF--
+<?php if (!extension_loaded("curl")) print "skip"; 
+?>
+--FILE--
+<?php
+$curl = curl_init();
+
+$fd = fopen('/tmp/test', 'wb');
+curl_setopt($curl, CURLOPT_FILE, $fd);
+
+curl_copy_handle($curl);
+
+echo 'DONE!';
+?>
+--EXPECTF--
+DONE!