MFB: fix #35781 (stream_filter_append() can cause segfault)

diff --git a/ext/standard/tests/file/bug35781.phpt b/ext/standard/tests/file/bug35781.phpt
new file mode 100644 (file)
index 0000000..5dc684a
--- /dev/null
+++ b/ext/standard/tests/file/bug35781.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #35781 (stream_filter_append() causes segfault)
+--FILE--
+<?php
+
+$filename = dirname(__FILE__)."/bug35781.txt";
+       
+$fp = fopen($filename, "w");
+stream_filter_append($fp, "string.rot13", -49);
+fwrite($fp, "This is a test\n");
+rewind($fp);
+fpassthru($fp);
+fclose($fp);
+
+var_dump(file_get_contents($filename));
+
+@unlink($filename);
+
+echo "Done\n";
+?>
+--EXPECTF--    
+string(15) "Guvf vf n grfg
+"
+Done

diff --git a/main/streams/plain_wrapper.c b/main/streams/plain_wrapper.c
index 83e0e74165f8d9663101b58910af9a5a1c46690e..6af0ba5f06f08877b4ad75f3119f9c41e775e6ce 100644 (file)
--- a/main/streams/plain_wrapper.c
+++ b/main/streams/plain_wrapper.c
@@ -316,7 +316,7 @@ static size_t php_stdiop_read(php_stream *stream, char *buf, size_t count TSRMLS
        if (data->fd >= 0) {
                ret = read(data->fd, buf, count);
                
-               stream->eof = (ret == 0 || (ret == -1 && errno != EWOULDBLOCK));
+               stream->eof = (ret == 0 || (ret == (size_t)-1 && errno != EWOULDBLOCK));
                                
        } else {
 #if HAVE_FLUSHIO

diff --git a/main/streams/streams.c b/main/streams/streams.c
index c9430fe73c28a39fb2af25b12d779e3789aa46ec..82e6a8aa208f80056d620a0e2d286427068a19c5 100755 (executable)
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -442,7 +442,7 @@ static void php_stream_fill_read_buffer(php_stream *stream, size_t size TSRMLS_D
 
                        /* read a chunk into a bucket */
                        justread = stream->ops->read(stream, chunk_buf, stream->chunk_size TSRMLS_CC);
-                       if (justread > 0) {
+                       if (justread != (size_t)-1) {
                                bucket = php_stream_bucket_new(stream, chunk_buf, justread, 0, 0 TSRMLS_CC);
 
                                /* after this call, bucket is owned by the brigade */
@@ -527,7 +527,7 @@ static void php_stream_fill_read_buffer(php_stream *stream, size_t size TSRMLS_D
                                        break;
                        }
 
-                       if (justread == 0) {
+                       if (justread == 0 || justread == (size_t)-1) {
                                break;
                        }
                }