Merge branch 'PHP-7.3' into PHP-7.4

* PHP-7.3:
  Fix #79191: Error in SoapClient ctor disables DOMDocument::save()

1 files changed, 21 insertions, 14 deletions

diff --git a/ext/xmlwriter/php_xmlwriter.c b/ext/xmlwriter/php_xmlwriter.c
index a4f1df3917..5cb141dad3 100644
--- a/ext/xmlwriter/php_xmlwriter.c
+++ b/ext/xmlwriter/php_xmlwriter.c
@@ -83,15 +83,13 @@ typedef int (*xmlwriter_read_int_t)(xmlTextWriterPtr writer);
 static void xmlwriter_free_resource_ptr(xmlwriter_object *intern)
 {
 	if (intern) {
-		if (EG(active)) {
-			if (intern->ptr) {
-				xmlFreeTextWriter(intern->ptr);
-				intern->ptr = NULL;
-			}
-			if (intern->output) {
-				xmlBufferFree(intern->output);
-				intern->output = NULL;
-			}
+		if (intern->ptr) {
+			xmlFreeTextWriter(intern->ptr);
+			intern->ptr = NULL;
+		}
+		if (intern->output) {
+			xmlBufferFree(intern->output);
+			intern->output = NULL;
 		}
 		efree(intern);
 	}
@@ -112,17 +110,25 @@ static void xmlwriter_free_resource_ptr(xmlwriter_object *intern)
 
 static zend_object_handlers xmlwriter_object_handlers;
 
-/* {{{ xmlwriter_object_free_storage */
-static void xmlwriter_object_free_storage(zend_object *object)
+/* {{{{ xmlwriter_object_dtor */
+static void xmlwriter_object_dtor(zend_object *object)
 {
 	ze_xmlwriter_object *intern = php_xmlwriter_fetch_object(object);
-	if (!intern) {
-		return;
-	}
+
+	/* freeing the resource here may leak, but otherwise we may use it after it has been freed */
 	if (intern->xmlwriter_ptr) {
 		xmlwriter_free_resource_ptr(intern->xmlwriter_ptr);
 	}
 	intern->xmlwriter_ptr = NULL;
+	zend_objects_destroy_object(object);
+}
+/* }}} */
+
+/* {{{ xmlwriter_object_free_storage */
+static void xmlwriter_object_free_storage(zend_object *object)
+{
+	ze_xmlwriter_object *intern = php_xmlwriter_fetch_object(object);
+
 	zend_object_std_dtor(&intern->std);
 }
 /* }}} */
@@ -1818,6 +1824,7 @@ static PHP_MINIT_FUNCTION(xmlwriter)
 
 	memcpy(&xmlwriter_object_handlers, &std_object_handlers, sizeof(zend_object_handlers));
 	xmlwriter_object_handlers.offset = XtOffsetOf(ze_xmlwriter_object, std);
+	xmlwriter_object_handlers.dtor_obj = xmlwriter_object_dtor;
 	xmlwriter_object_handlers.free_obj = xmlwriter_object_free_storage;
 	xmlwriter_object_handlers.clone_obj = NULL;
 	INIT_CLASS_ENTRY(ce, "XMLWriter", xmlwriter_class_functions);