From 41bc51ce2d217aa7aca85b4be289bebf91813423 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Mon, 18 Mar 2019 18:47:34 +0100
Subject: Fix #77578: Crash when php unload

Since we're putting `ITypeLib *`s into the hash, we're getting
`ITypeLib *`s back, not `ITypeLib **`s.
---
 NEWS                               |  3 +++
 ext/com_dotnet/com_typeinfo.c      |  4 ++--
 ext/com_dotnet/tests/bug77578.phpt | 23 +++++++++++++++++++++++
 3 files changed, 28 insertions(+), 2 deletions(-)
 create mode 100644 ext/com_dotnet/tests/bug77578.phpt

diff --git a/NEWS b/NEWS
index abf5a572d3..1e953a1176 100644
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,9 @@ PHP                                                                        NEWS
   . Fixed bug #77742 (bcpow() implementation related to gcc compiler
     optimization). (Nikita)
 
+- COM:
+  . Fixed bug #77578 (Crash when php unload). (cmb)
+
 - Date:
   . Fixed bug #50020 (DateInterval:createDateFromString() silently fails).
     (Derick)
diff --git a/ext/com_dotnet/com_typeinfo.c b/ext/com_dotnet/com_typeinfo.c
index 40f21aea6b..1847a565a2 100644
--- a/ext/com_dotnet/com_typeinfo.c
+++ b/ext/com_dotnet/com_typeinfo.c
@@ -225,8 +225,8 @@ PHP_COM_DOTNET_API int php_com_import_typelib(ITypeLib *TL, int mode, int codepa
 /* Type-library stuff */
 void php_com_typelibrary_dtor(zval *pDest)
 {
-	ITypeLib **Lib = (ITypeLib**)Z_PTR_P(pDest);
-	ITypeLib_Release(*Lib);
+	ITypeLib *Lib = (ITypeLib*)Z_PTR_P(pDest);
+	ITypeLib_Release(Lib);
 }
 
 PHP_COM_DOTNET_API ITypeLib *php_com_load_typelib_via_cache(char *search_string,
diff --git a/ext/com_dotnet/tests/bug77578.phpt b/ext/com_dotnet/tests/bug77578.phpt
new file mode 100644
index 0000000000..e68494468e
--- /dev/null
+++ b/ext/com_dotnet/tests/bug77578.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #77578 (Crash when php unload)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+// To actually be able to verify the crash during shutdown on Windows, we have
+// to execute a PHP subprocess, and check its exit status.
+$php = PHP_BINARY;
+$ini = php_ini_loaded_file();
+$iniopt = $ini ? "-c $ini" : '';
+$command = "$php $iniopt -d com.autoregister_typelib=1 -r \"new COM('WbemScripting.SWbemLocator');\"";
+exec($command, $output, $status);
+var_dump($output, $status);
+?>
+===DONE===
+--EXPECT--
+array(0) {
+}
+int(0)
+===DONE===
-- 
cgit v1.2.1