MFB51: Fixed bug #35916 (Duplicate calls to stream_bucket_append() lead to

a crash).

diff --git a/ext/standard/tests/filters/bug35916.phpt b/ext/standard/tests/filters/bug35916.phpt
new file mode 100644 (file)
index 0000000..4d2027d
--- /dev/null
+++ b/ext/standard/tests/filters/bug35916.phpt
@@ -0,0 +1,42 @@
+--TEST--
+Bug #35916 (Duplicate calls to stream_bucket_append() lead to a crash)
+--FILE--
+<?php
+$file = dirname(__FILE__) . "/bug35916.txt";
+@unlink($file);
+
+class strtoupper_filter extends php_user_filter
+{
+        function filter($in, $out, &$consumed, $closing)
+        {
+               while($bucket=stream_bucket_make_writeable($in)) {
+                       $bucket->data = strtoupper($bucket->data);
+                       $consumed += $bucket->datalen;
+                       stream_bucket_append($out, $bucket);
+                       stream_bucket_append($out, $bucket);
+                }
+               return PSFS_PASS_ON;
+        }
+       function onCreate()
+       {
+               echo "fffffffffff\n";
+       }
+       function onClose()
+       {
+               echo "hello\n";
+       }
+}
+
+stream_filter_register("strtoupper", "strtoupper_filter");
+$fp=fopen($file, "w");
+stream_filter_append($fp,  "strtoupper");
+fread($fp, 1024);
+fwrite($fp, "Thank you\n");
+fclose($fp);
+readfile($file);
+unlink($file);
+?>
+--EXPECT--
+fffffffffff
+hello
+THANK YOU

diff --git a/main/streams/filter.c b/main/streams/filter.c
index 188fe0db1aa6dca98e22d9c8610587d40b3c43f0..0e6c8bbbd61a6b6f3a50a6e94391ea140964ac66 100644 (file)
--- a/main/streams/filter.c
+++ b/main/streams/filter.c
@@ -273,6 +273,10 @@ PHPAPI void php_stream_bucket_prepend(php_stream_bucket_brigade *brigade, php_st
 
 PHPAPI void php_stream_bucket_append(php_stream_bucket_brigade *brigade, php_stream_bucket *bucket TSRMLS_DC)
 {
+       if (brigade->tail == bucket) {
+               return;
+       }
+
        bucket->prev = brigade->tail;
        bucket->next = NULL;