Merge branch 'PHP-8.4'

* PHP-8.4:
  Fix GH-17650: realloc with size 0 in user_filters.c
This commit is contained in:
Niels Dossche 2025-02-07 20:24:07 +01:00
commit d3e5dbe45b
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
2 changed files with 36 additions and 1 deletions

View file

@ -0,0 +1,35 @@
--TEST--
GH-17650 (realloc with size 0 in user_filters.c)
--FILE--
<?php
class testfilter extends php_user_filter {
function filter($in, $out, &$consumed, $closing): int {
while ($bucket = stream_bucket_make_writeable($in)) {
$bucket->data = '';
$consumed += strlen($bucket->data);
stream_bucket_append($out, $bucket);
}
return PSFS_PASS_ON;
}
}
stream_filter_register('testfilter','testfilter');
$text = "Hello There!";
$fp = fopen('php://memory', 'w+');
fwrite($fp, $text);
rewind($fp);
stream_filter_append($fp, 'testfilter', STREAM_FILTER_READ, 'testuserfilter');
while ($x = fgets($fp)) {
var_dump($x);
}
fclose($fp);
echo "Done\n";
?>
--EXPECT--
Done

View file

@ -402,7 +402,7 @@ static void php_stream_bucket_attach(int append, INTERNAL_FUNCTION_PARAMETERS)
bucket = php_stream_bucket_make_writeable(bucket); bucket = php_stream_bucket_make_writeable(bucket);
} }
if (bucket->buflen != Z_STRLEN_P(pzdata)) { if (bucket->buflen != Z_STRLEN_P(pzdata)) {
bucket->buf = perealloc(bucket->buf, Z_STRLEN_P(pzdata), bucket->is_persistent); bucket->buf = perealloc(bucket->buf, MAX(Z_STRLEN_P(pzdata), 1), bucket->is_persistent);
bucket->buflen = Z_STRLEN_P(pzdata); bucket->buflen = Z_STRLEN_P(pzdata);
} }
memcpy(bucket->buf, Z_STRVAL_P(pzdata), bucket->buflen); memcpy(bucket->buf, Z_STRVAL_P(pzdata), bucket->buflen);