fix Bug #46147: after stream seek, appending stream filter reads incorrect data

diff --git a/NEWS b/NEWS
index 98aaf6d3a15f8b86faa72bd8e72855ac5b214b05..5c152ac57a61e110c9e76a93a678ffccec851c59 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,8 @@ PHP                                                                        NEWS
   (Scott)
 - Fixed a crash on invalid method in ReflectionParameter constructor.
   (Christian Seiler)
+- Fixed Bug #46147 (after stream seek, appending stream filter reads incorrect data).
+  (Greg)
 - Fixed bug #46059 (Compile failure under IRIX 6.5.30 building posix.c). 
   (Arnaud)
 - Fixed bug #46053 (SplFileObject::seek - Endless loop). (Arnaud)

diff --git a/main/streams/filter.c b/main/streams/filter.c
index d0ea166403ec4910e4c9db7a2f3ff6b788dd5d9d..ae3605ccdbb7d58fa34435c76e31dc831301f4eb 100644 (file)
--- a/main/streams/filter.c
+++ b/main/streams/filter.c
@@ -381,15 +381,12 @@ PHPAPI void _php_stream_filter_append(php_stream_filter_chain *chain, php_stream
                                stream->writepos = 0;
                                break;
                        case PSFS_PASS_ON:
-                               /* Put any filtered data onto the readbuffer stack.
-                                  Previously read data has been at least partially consumed. */
-                               stream->readpos += consumed;
-
-                               if (stream->writepos == stream->readpos) {
-                                       /* Entirely consumed */
-                                       stream->writepos = 0;
-                                       stream->readpos = 0;
-                               }
+                               /* If any data is consumed, we cannot rely upon the existing read buffer,
+                                  as the filtered data must replace the existing data, so invalidate the cache */
+                               /* note that changes here should be reflected in
+                                  main/streams/streams.c::php_stream_fill_read_buffer */
+                               stream->writepos = 0;
+                               stream->readpos = 0;
 
                                while (brig_outp->head) {
                                        bucket = brig_outp->head;

diff --git a/main/streams/streams.c b/main/streams/streams.c
index c18c17e7362e1758c7b38bbf3a620db28fe87423..66d2e2a82d1cdeb74ba0e3ede8d91b44da3ecfe4 100755 (executable)
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -438,6 +438,10 @@ static void php_stream_fill_read_buffer(php_stream *stream, size_t size TSRMLS_D
                php_stream_bucket_brigade brig_in = { NULL, NULL }, brig_out = { NULL, NULL };
                php_stream_bucket_brigade *brig_inp = &brig_in, *brig_outp = &brig_out, *brig_swap;
 
+               /* Invalidate the existing cache, otherwise reads can fail, see note in
+                  main/streams/filter.c::_php_stream_filter_append */
+               stream->writepos = stream->readpos = 0;
+
                /* allocate a buffer for reading chunks */
                chunk_buf = emalloc(stream->chunk_size);