From: Antony Dovgal <tony2001@php.net>
Date: Fri, 23 Dec 2005 14:32:11 +0000 (+0000)
Subject: fix #35781 (stream_filter_append() can cause segfault)
X-Git-Tag: php-5.1.2RC2~101
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=248be6fcfc7782d9b73e47de5979eea5a7fc0a5e;p=php

fix #35781 (stream_filter_append() can cause segfault)
---

diff --git a/ext/standard/tests/file/bug35781.phpt b/ext/standard/tests/file/bug35781.phpt
new file mode 100644
index 0000000000..5dc684a65d
--- /dev/null
+++ b/ext/standard/tests/file/bug35781.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #35781 (stream_filter_append() causes segfault)
+--FILE--
+<?php
+
+$filename = dirname(__FILE__)."/bug35781.txt";
+	
+$fp = fopen($filename, "w");
+stream_filter_append($fp, "string.rot13", -49);
+fwrite($fp, "This is a test\n");
+rewind($fp);
+fpassthru($fp);
+fclose($fp);
+
+var_dump(file_get_contents($filename));
+
+@unlink($filename);
+
+echo "Done\n";
+?>
+--EXPECTF--	
+string(15) "Guvf vf n grfg
+"
+Done
diff --git a/main/streams/plain_wrapper.c b/main/streams/plain_wrapper.c
index 83e0e74165..6af0ba5f06 100644
--- a/main/streams/plain_wrapper.c
+++ b/main/streams/plain_wrapper.c
@@ -316,7 +316,7 @@ static size_t php_stdiop_read(php_stream *stream, char *buf, size_t count TSRMLS
 	if (data->fd >= 0) {
 		ret = read(data->fd, buf, count);
 		
-		stream->eof = (ret == 0 || (ret == -1 && errno != EWOULDBLOCK));
+		stream->eof = (ret == 0 || (ret == (size_t)-1 && errno != EWOULDBLOCK));
 				
 	} else {
 #if HAVE_FLUSHIO
diff --git a/main/streams/streams.c b/main/streams/streams.c
index 6a3b3848b3..f4d6b2bab1 100755
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -442,7 +442,7 @@ static void php_stream_fill_read_buffer(php_stream *stream, size_t size TSRMLS_D
 
 			/* read a chunk into a bucket */
 			justread = stream->ops->read(stream, chunk_buf, stream->chunk_size TSRMLS_CC);
-			if (justread > 0) {
+			if (justread != (size_t)-1) {
 				bucket = php_stream_bucket_new(stream, chunk_buf, justread, 0, 0 TSRMLS_CC);
 
 				/* after this call, bucket is owned by the brigade */
@@ -511,7 +511,7 @@ static void php_stream_fill_read_buffer(php_stream *stream, size_t size TSRMLS_D
 					break;
 			}
 
-			if (justread == 0) {
+			if (justread == 0 || justread == (size_t)-1) {
 				break;
 			}
 		}