From d2397a9301c9e0892701e456ccbec8a022ba4e93 Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <iliaa@php.net>
Date: Tue, 10 Jan 2006 16:14:45 +0000
Subject: [PATCH] MFB51: Fixed bug #35916 (Duplicate calls to
 stream_bucket_append() lead to a crash).

---
 ext/standard/tests/filters/bug35916.phpt | 42 ++++++++++++++++++++++++
 main/streams/filter.c                    |  4 +++
 2 files changed, 46 insertions(+)
 create mode 100644 ext/standard/tests/filters/bug35916.phpt

diff --git a/ext/standard/tests/filters/bug35916.phpt b/ext/standard/tests/filters/bug35916.phpt
new file mode 100644
index 0000000000..4d2027d249
--- /dev/null
+++ b/ext/standard/tests/filters/bug35916.phpt
@@ -0,0 +1,42 @@
+--TEST--
+Bug #35916 (Duplicate calls to stream_bucket_append() lead to a crash)
+--FILE--
+<?php
+$file = dirname(__FILE__) . "/bug35916.txt";
+@unlink($file);
+
+class strtoupper_filter extends php_user_filter
+{
+        function filter($in, $out, &$consumed, $closing)
+        {
+		while($bucket=stream_bucket_make_writeable($in)) {
+			$bucket->data = strtoupper($bucket->data);
+			$consumed += $bucket->datalen;
+			stream_bucket_append($out, $bucket);
+			stream_bucket_append($out, $bucket);
+                }
+		return PSFS_PASS_ON;
+        }
+	function onCreate()
+	{
+		echo "fffffffffff\n";
+	}
+	function onClose()
+	{
+		echo "hello\n";
+	}
+}
+
+stream_filter_register("strtoupper", "strtoupper_filter");
+$fp=fopen($file, "w");
+stream_filter_append($fp,  "strtoupper");
+fread($fp, 1024);
+fwrite($fp, "Thank you\n");
+fclose($fp);
+readfile($file);
+unlink($file);
+?>
+--EXPECT--
+fffffffffff
+hello
+THANK YOU
diff --git a/main/streams/filter.c b/main/streams/filter.c
index 188fe0db1a..0e6c8bbbd6 100644
--- a/main/streams/filter.c
+++ b/main/streams/filter.c
@@ -273,6 +273,10 @@ PHPAPI void php_stream_bucket_prepend(php_stream_bucket_brigade *brigade, php_st
 
 PHPAPI void php_stream_bucket_append(php_stream_bucket_brigade *brigade, php_stream_bucket *bucket TSRMLS_DC)
 {
+	if (brigade->tail == bucket) {
+		return;
+	}
+
 	bucket->prev = brigade->tail;
 	bucket->next = NULL;
 
-- 
2.40.0