BugFix #31137 stream_filter_remove() segfaults when stream already closed

diff --git a/ext/standard/streamsfuncs.c b/ext/standard/streamsfuncs.c
index 8c04af9e86de084a016546c76a92274a760751a5..7d2a6ed37f649ffe5326096812a37c4708887372 100644 (file)
--- a/ext/standard/streamsfuncs.c
+++ b/ext/standard/streamsfuncs.c
@@ -1097,7 +1097,7 @@ static void apply_filter_to_stream(int append, INTERNAL_FUNCTION_PARAMETERS)
        }
 
        if (filter) {
-               RETURN_RESOURCE(ZEND_REGISTER_RESOURCE(NULL, filter, php_file_le_stream_filter()));
+               RETURN_RESOURCE(filter->rsrc_id = ZEND_REGISTER_RESOURCE(NULL, filter, php_file_le_stream_filter()));
        } else {
                RETURN_FALSE;
        }

diff --git a/main/streams/filter.c b/main/streams/filter.c
index 37ab4c14d568255f89b93bc256937d31d0ba92ec..dc596148884ef1d52c72b7c466215b3ae84dbe36 100644 (file)
--- a/main/streams/filter.c
+++ b/main/streams/filter.c
@@ -499,6 +499,11 @@ PHPAPI php_stream_filter *php_stream_filter_remove(php_stream_filter *filter, in
        } else {
                filter->chain->tail = filter->prev;
        }
+
+       if (filter->rsrc_id > 0) {
+               zend_list_delete(filter->rsrc_id);
+       }
+
        if (call_dtor) {
                php_stream_filter_free(filter TSRMLS_CC);
                return NULL;

diff --git a/main/streams/php_stream_filter_api.h b/main/streams/php_stream_filter_api.h
index 6ee8192923a5222ff697e3f7ffc11c4043a467a5..115fe2486b2553cfa042ae39a544520bf8f4da11 100644 (file)
--- a/main/streams/php_stream_filter_api.h
+++ b/main/streams/php_stream_filter_api.h
@@ -117,6 +117,9 @@ struct _php_stream_filter {
 
        /* buffered buckets */
        php_stream_bucket_brigade buffer;
+
+       /* filters are auto_registered when they're applied */
+       int rsrc_id;
 };
 
 /* stack filter onto a stream */