curl: Fix cloning of POST fields (php#19813)

Author: TimWolla

NEWS

@@ -9,6 +9,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-19792 (SCCP causes UAF for return value if both warning and
     exception are triggered). (nielsdos)
 
+- Curl:
+  . Fix cloning of CURLOPT_POSTFIELDS when using the clone operator instead
+    of the curl_copy_handle() function to clone a CurlHandle.
+
 - Standard:
   . Fixed bug GH-12265 (Cloning an object breaks serialization recursion).
     (nielsdos)

ext/curl/interface.c

@@ -468,7 +468,7 @@ static zend_object *curl_clone_obj(zend_object *object) {
 	clone_ch->cp = cp;
 	_php_setup_easy_copy_handlers(clone_ch, ch);
 
-	postfields = &clone_ch->postfields;
+	postfields = &ch->postfields;
 	if (Z_TYPE_P(postfields) != IS_UNDEF) {
 		if (build_mime_structure_from_hash(clone_ch, postfields) == FAILURE) {
 			zend_throw_exception(NULL, "Failed to clone CurlHandle", 0);

ext/curl/tests/curl_copy_handle_variation3_clone.phpt

@@ -0,0 +1,34 @@
+--TEST--
+clone() allows to post CURLFile multiple times
+--EXTENSIONS--
+curl
+--FILE--
+<?php
+include 'server.inc';
+$host = curl_cli_server_start();
+
+$ch1 = curl_init();
+curl_setopt($ch1, CURLOPT_SAFE_UPLOAD, 1);
+curl_setopt($ch1, CURLOPT_URL, "{$host}/get.php?test=file");
+curl_setopt($ch1, CURLOPT_RETURNTRANSFER, 1);
+
+$filename = __DIR__ . '/curl_copy_handle_variation3_clone.txt';
+file_put_contents($filename, "Test.");
+$file = curl_file_create($filename);
+$params = array('file' => $file);
+var_dump(curl_setopt($ch1, CURLOPT_POSTFIELDS, $params));
+
+$ch2 = clone($ch1);
+
+var_dump(curl_exec($ch1));
+
+var_dump(curl_exec($ch2));
+?>
+--EXPECTF--
+bool(true)
+string(%d) "curl_copy_handle_variation3_clone.txt|application/octet-stream|5"
+string(%d) "curl_copy_handle_variation3_clone.txt|application/octet-stream|5"
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/curl_copy_handle_variation3_clone.txt');
+?>