diff --git a/NEWS b/NEWS index f4a16fe24b0..b7f551e1d4e 100644 --- a/NEWS +++ b/NEWS @@ -22,6 +22,9 @@ PHP NEWS (George Dietrich) . Fixed bug #74960 (Heap buffer overflow via str_repeat). (cmb, Dmitry) +- Streams: + . Fixed bug #81294 (Segfault when removing a filter). (cmb) + 29 Jul 2021, PHP 7.4.22 - Core: diff --git a/ext/standard/tests/filters/bug81294.phpt b/ext/standard/tests/filters/bug81294.phpt new file mode 100644 index 00000000000..195d17b6c8a --- /dev/null +++ b/ext/standard/tests/filters/bug81294.phpt @@ -0,0 +1,24 @@ +--TEST-- +Bug #81294 (Segfault when removing a filter) +--SKIPIF-- + +--FILE-- + +--CLEAN-- + +--EXPECT-- +string(16) "%2BV-.%01%00grfg" diff --git a/main/streams/filter.c b/main/streams/filter.c index f536b92a022..a86b6b16d7a 100644 --- a/main/streams/filter.c +++ b/main/streams/filter.c @@ -418,7 +418,7 @@ PHPAPI int _php_stream_filter_flush(php_stream_filter *filter, int finish) for(current = filter; current; current = current->next) { php_stream_filter_status_t status; - status = filter->fops->filter(stream, current, inp, outp, NULL, flags); + status = current->fops->filter(stream, current, inp, outp, NULL, flags); if (status == PSFS_FEED_ME) { /* We've flushed the data far enough */ return SUCCESS;