Merge branch 'PHP-7.3' into PHP-7.4

* PHP-7.3:
  Fix #79191: Error in SoapClient ctor disables DOMDocument::save()

6 files changed, 77 insertions, 21 deletions

diff --git a/NEWS b/NEWS
index 6745647a00..799258c0bc 100644
--- a/NEWS
+++ b/NEWS
@@ -27,6 +27,10 @@ PHP                                                                        NEWS
  -Intl:
   . Fixed bug #79212 (NumberFormatter::format() may detect wrong type). (cmb)
 
+- Libxml:
+  . Fixed bug #79191 (Error in SoapClient ctor disables DOMDocument::save()).
+    (Nikita, cmb)
+
 - MBString:
   . Fixed bug #79149 (SEGV in mb_convert_encoding with non-string encodings).
     (cmb)
diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
index 360d1999e7..c024e16670 100644
--- a/ext/libxml/libxml.c
+++ b/ext/libxml/libxml.c
@@ -382,9 +382,6 @@ static int php_libxml_streams_IO_read(void *context, char *buffer, int len)
 
 static int php_libxml_streams_IO_write(void *context, const char *buffer, int len)
 {
-	if (CG(unclean_shutdown)) {
-		return -1;
-	}
 	return php_stream_write((php_stream*)context, buffer, len);
 }
 
diff --git a/ext/libxml/tests/bug79191.phpt b/ext/libxml/tests/bug79191.phpt
new file mode 100644
index 0000000000..7d0dc83f23
--- /dev/null
+++ b/ext/libxml/tests/bug79191.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #79191 (Error in SoapClient ctor disables DOMDocument::save())
+--SKIPIF--
+<?php
+if (!extension_loaded('soap')) die('skip soap extension not available');
+if (!extension_loaded('dom')) die('dom extension not available');
+?>
+--FILE--
+<?php
+try {
+    new \SoapClient('does-not-exist.wsdl');
+} catch (Throwable $t) {
+}
+
+$dom = new DOMDocument;
+$dom->loadxml('<?xml version="1.0" ?><root />');
+var_dump($dom->save(__DIR__ . '/bug79191.xml'));
+?>
+--CLEAN--
+<?php
+unlink(__DIR__ . '/bug79191.xml');
+?>
+--EXPECTF--
+int(%d)
diff --git a/ext/xmlwriter/php_xmlwriter.c b/ext/xmlwriter/php_xmlwriter.c
index a4f1df3917..5cb141dad3 100644
--- a/ext/xmlwriter/php_xmlwriter.c
+++ b/ext/xmlwriter/php_xmlwriter.c
@@ -83,15 +83,13 @@ typedef int (*xmlwriter_read_int_t)(xmlTextWriterPtr writer);
 static void xmlwriter_free_resource_ptr(xmlwriter_object *intern)
 {
 	if (intern) {
-		if (EG(active)) {
-			if (intern->ptr) {
-				xmlFreeTextWriter(intern->ptr);
-				intern->ptr = NULL;
-			}
-			if (intern->output) {
-				xmlBufferFree(intern->output);
-				intern->output = NULL;
-			}
+		if (intern->ptr) {
+			xmlFreeTextWriter(intern->ptr);
+			intern->ptr = NULL;
+		}
+		if (intern->output) {
+			xmlBufferFree(intern->output);
+			intern->output = NULL;
 		}
 		efree(intern);
 	}
@@ -112,17 +110,25 @@ static void xmlwriter_free_resource_ptr(xmlwriter_object *intern)
 
 static zend_object_handlers xmlwriter_object_handlers;
 
-/* {{{ xmlwriter_object_free_storage */
-static void xmlwriter_object_free_storage(zend_object *object)
+/* {{{{ xmlwriter_object_dtor */
+static void xmlwriter_object_dtor(zend_object *object)
 {
 	ze_xmlwriter_object *intern = php_xmlwriter_fetch_object(object);
-	if (!intern) {
-		return;
-	}
+
+	/* freeing the resource here may leak, but otherwise we may use it after it has been freed */
 	if (intern->xmlwriter_ptr) {
 		xmlwriter_free_resource_ptr(intern->xmlwriter_ptr);
 	}
 	intern->xmlwriter_ptr = NULL;
+	zend_objects_destroy_object(object);
+}
+/* }}} */
+
+/* {{{ xmlwriter_object_free_storage */
+static void xmlwriter_object_free_storage(zend_object *object)
+{
+	ze_xmlwriter_object *intern = php_xmlwriter_fetch_object(object);
+
 	zend_object_std_dtor(&intern->std);
 }
 /* }}} */
@@ -1818,6 +1824,7 @@ static PHP_MINIT_FUNCTION(xmlwriter)
 
 	memcpy(&xmlwriter_object_handlers, &std_object_handlers, sizeof(zend_object_handlers));
 	xmlwriter_object_handlers.offset = XtOffsetOf(ze_xmlwriter_object, std);
+	xmlwriter_object_handlers.dtor_obj = xmlwriter_object_dtor;
 	xmlwriter_object_handlers.free_obj = xmlwriter_object_free_storage;
 	xmlwriter_object_handlers.clone_obj = NULL;
 	INIT_CLASS_ENTRY(ce, "XMLWriter", xmlwriter_class_functions);
diff --git a/ext/xmlwriter/tests/bug71536.phpt b/ext/xmlwriter/tests/bug71536.phpt
new file mode 100644
index 0000000000..4ce2f2e404
--- /dev/null
+++ b/ext/xmlwriter/tests/bug71536.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #71536 (Access Violation crashes php-cgi.exe)
+--SKIPIF--
+<?php
+if (!extension_loaded('xmlwriter')) die('skip xmlwriter extension not available');
+?>
+--FILE--
+<?php
+class Test {
+    public static function init()
+    {
+        $xml = new \XMLWriter();
+        $xml->openUri('php://memory');
+        $xml->setIndent(false);
+        $xml->startDocument('1.0', 'UTF-8');
+        $xml->startElement('response');
+        die('now'); // crashed with die()
+    }
+}
+
+Test::init();
+?>
+--EXPECT--
+now
diff --git a/ext/xmlwriter/tests/bug79029.phpt b/ext/xmlwriter/tests/bug79029.phpt
index 2e76a4e409..b6b0c84b18 100644
--- a/ext/xmlwriter/tests/bug79029.phpt
+++ b/ext/xmlwriter/tests/bug79029.phpt
@@ -11,13 +11,13 @@ $x = array( new XMLWriter() );
 $x[0]->openUri("bug79029_1.txt");
 $x[0]->startComment();
 
-$x = new XMLWriter();
-$x->openUri("bug79029_2.txt");
+$y = new XMLWriter();
+$y->openUri("bug79029_2.txt");
 fclose(@end(get_resources()));
 
 file_put_contents("bug79029_3.txt", "a");
-$x = new XMLReader();
-$x->open("bug79029_3.txt");
+$z = new XMLReader();
+$z->open("bug79029_3.txt");
 fclose(@end(get_resources()));
 ?>
 okey