From: Arnaud Le Blanc <lbarnaud@php.net>
Date: Sun, 5 Oct 2008 01:40:02 +0000 (+0000)
Subject: Fixed #46164 (stream_filter_remove() closes the stream)
X-Git-Tag: BEFORE_HEAD_NS_CHANGE~285
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d4cb99a9767167901f37cfa7986eba2797550ff8;p=php

Fixed #46164 (stream_filter_remove() closes the stream)
---

diff --git a/ext/standard/tests/filters/bug46164-1.phpt b/ext/standard/tests/filters/bug46164-1.phpt
new file mode 100644
index 0000000000..b2d2d4e85d
--- /dev/null
+++ b/ext/standard/tests/filters/bug46164-1.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #46164 - 1 (stream_filter_remove() closes the stream)
+--FILE--
+<?php
+class user_filter extends php_user_filter {
+	function filter($in, $out, &$consumed, $closing) {
+		while($bucket = stream_bucket_make_writeable($in)) {
+			$consumed += $bucket->datalen;
+			stream_bucket_append($out, $bucket);
+		}
+		return PSFS_PASS_ON;
+	}
+}
+stream_filter_register('user_filter','user_filter');
+
+$fd = fopen('php://memory','w');
+$filter = stream_filter_append($fd, 'user_filter');
+stream_filter_remove($filter);
+var_dump(fclose($fd));
+?>
+--EXPECT--
+bool(true)
diff --git a/ext/standard/tests/filters/bug46164-2.phpt b/ext/standard/tests/filters/bug46164-2.phpt
new file mode 100644
index 0000000000..2e060aca43
--- /dev/null
+++ b/ext/standard/tests/filters/bug46164-2.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #46164 - 2 (stream_filter_remove() closes the stream)
+--FILE--
+<?php
+class user_filter extends php_user_filter {
+	function filter($in, $out, &$consumed, $closing) {
+		while($bucket = stream_bucket_make_writeable($in)) {
+			$consumed += $bucket->datalen;
+			stream_bucket_append($out, $bucket);
+		}
+		unset($this->stream);
+		return PSFS_PASS_ON;
+	}
+}
+stream_filter_register('user_filter','user_filter');
+
+$fd = fopen('php://memory','w');
+$filter = stream_filter_append($fd, 'user_filter');
+fwrite($fd, b"foo");
+fflush($fd);
+var_dump(fclose($fd));
+?>
+--EXPECT--
+bool(true)
diff --git a/ext/standard/user_filters.c b/ext/standard/user_filters.c
index 1d887a5475..3d23d22b90 100644
--- a/ext/standard/user_filters.c
+++ b/ext/standard/user_filters.c
@@ -183,12 +183,14 @@ php_stream_filter_status_t userfilter_filter( php_stream *stream, php_stream_fil
 	zval *retval = NULL;
 	zval **args[4];
 	zval *zclosing, *zconsumed, *zin, *zout, *zstream;
+	zval zpropname;
 	int call_result;
 
 	if (FAILURE == zend_hash_find(Z_OBJPROP_P(obj), "stream", sizeof("stream"), (void**)&zstream)) {
 		/* Give the userfilter class a hook back to the stream */
 		ALLOC_INIT_ZVAL(zstream);
 		php_stream_to_zval(stream, zstream);
+		zval_copy_ctor(zstream);
 		add_property_zval(obj, "stream", zstream);
 		/* add_property_zval increments the refcount which is unwanted here */
 		zval_ptr_dtor(&zstream);
@@ -247,6 +249,13 @@ php_stream_filter_status_t userfilter_filter( php_stream *stream, php_stream_fil
 		}
 	}
 
+	/* filter resources are cleaned up by the stream destructor,
+	 * keeping a reference to the stream resource here would prevent it
+	 * from being destroyed properly */
+	INIT_ZVAL(zpropname);
+	ZVAL_STRINGL(&zpropname, "stream", sizeof("stream")-1, 0);
+	Z_OBJ_HANDLER_P(obj, unset_property)(obj, &zpropname TSRMLS_CC);
+
 	zval_ptr_dtor(&zclosing);
 	zval_ptr_dtor(&zconsumed);
 	zval_ptr_dtor(&zout);