Fixed bug #35916 (Duplicate calls to stream_bucket_append() lead to a crash).

diff --git a/NEWS b/NEWS
index c1f058c2fa620d05dd378bcc4231500895d5397c..7582de1268e8b20b268e1452ba1b61e234de2ca2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,8 @@ PHP                                                                        NEWS
 - Fixed segfault/leak in imagecolormatch(). (Pierre)
 - Fixed small leak in mysqli_stmt_fetch() when bound variable was empty string.
   (Andrey)
+- Fixed bug #35916 (Duplicate calls to stream_bucket_append() lead to a crash).
+  (Ilia)
 - Fixed bug #35908 (curl extension uses undefined GCRY_THREAD_OPTIONS_USER).
   (Ilia)
 - Fixed bug #35907 (PDO_OCI uses hardcoded lib path $ORACLE_HOME/lib). (Tony)

diff --git a/ext/standard/tests/filters/bug35916.phpt b/ext/standard/tests/filters/bug35916.phpt
new file mode 100644 (file)
index 0000000..4d2027d
--- /dev/null
+++ b/ext/standard/tests/filters/bug35916.phpt
@@ -0,0 +1,42 @@
+--TEST--
+Bug #35916 (Duplicate calls to stream_bucket_append() lead to a crash)
+--FILE--
+<?php
+$file = dirname(__FILE__) . "/bug35916.txt";
+@unlink($file);
+
+class strtoupper_filter extends php_user_filter
+{
+        function filter($in, $out, &$consumed, $closing)
+        {
+               while($bucket=stream_bucket_make_writeable($in)) {
+                       $bucket->data = strtoupper($bucket->data);
+                       $consumed += $bucket->datalen;
+                       stream_bucket_append($out, $bucket);
+                       stream_bucket_append($out, $bucket);
+                }
+               return PSFS_PASS_ON;
+        }
+       function onCreate()
+       {
+               echo "fffffffffff\n";
+       }
+       function onClose()
+       {
+               echo "hello\n";
+       }
+}
+
+stream_filter_register("strtoupper", "strtoupper_filter");
+$fp=fopen($file, "w");
+stream_filter_append($fp,  "strtoupper");
+fread($fp, 1024);
+fwrite($fp, "Thank you\n");
+fclose($fp);
+readfile($file);
+unlink($file);
+?>
+--EXPECT--
+fffffffffff
+hello
+THANK YOU

diff --git a/main/streams/filter.c b/main/streams/filter.c
index 92353a796b3791b2ddbd516a1db9b5135fad690a..baa6211226ac5acc679767c9735fa3ca12bbbf70 100644 (file)
--- a/main/streams/filter.c
+++ b/main/streams/filter.c
@@ -204,6 +204,10 @@ PHPAPI void php_stream_bucket_prepend(php_stream_bucket_brigade *brigade, php_st
 
 PHPAPI void php_stream_bucket_append(php_stream_bucket_brigade *brigade, php_stream_bucket *bucket TSRMLS_DC)
 {
+       if (brigade->tail == bucket) {
+               return;
+       }
+
        bucket->prev = brigade->tail;
        bucket->next = NULL;