#38420 [NEW]: stream_filter_append function with a zlib filter segfaults or hangs

From: rb at ez dot no Operating system: Linux PHP version: 5.1.4 PHP Bug Type: Reproducible crash Bug description: stream_filter_append function with a zlib filter segfaults or hangs Description: ------------ The application I am writing uses the stream_filter_append() function to inflate / decompress a part of the file content. Unfortunately, this results into a segmentation fault. I wrote a small script to reproduce this problem, but that script hangs instead of segfaults. There may be a relation. Backtracing the segfault shows that there is a null pointer assignment (thanks to Derick). Reproduce code: --------------- // Script that hangs. // Compress $fw = fopen( "myfile.txt", "r+b" ); stream_filter_append( $fw, "zlib.deflate"); fwrite( $fw, "Hello world" ); fclose($fw); // Decompress $fr = fopen( "myfile.txt", "r+b" ); stream_filter_append( $fr, "zlib.inflate"); echo fread( $fr, 100 ); fclose($fr); Actual result: -------------- // Backtrace from the crash ( brigade = 0x0 ). Program received signal SIGSEGV, Segmentation fault. 0x081fcc88 in php_stream_bucket_unlink (bucket=0x885d0f4) at /usr/local/php/php5/src/main/streams/filter.c:228 228 bucket->brigade->head = bucket->next; (gdb) print *bucket $1 = {next = 0x0, prev = 0x0, brigade = 0x0, buf = 0x8860cf5 "[\017TT×\231\177\203O\235\220Á\231\032\210\230b| f\237\t&8\202ÑFü\027P4º¥J\024+Y10ÂÈÌf\230¡3o@ÏÒ\0262`xû¤%'vÛmmÖ\234¶©ÝX\213©5\202\215¢¸þIÒ¬Ñ\234mZ³)©\232Ì\004í1Ñ\030Z­ ³¿ïÞ;ð \230Äö\234=gÏöéÇ}ß½ßýþÝ{¿ïÞ7ï}}Qáb\213Å\"%®$i\204DX\203. [g l\233ÉëgH\212d\2252¥;¤ñÒ(\206\003\032@\003`\035", buflen = 7762, own_buf = 0, is_persistent = 0, refcount = 0} -- Edit bug report at http://bugs.php.net/?id=38420&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=38420&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=38420&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=38420&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=38420&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=38420&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=38420&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=38420&r=needscript Try newer version: http://bugs.php.net/fix.php?id=38420&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=38420&r=support Expected behavior: http://bugs.php.net/fix.php?id=38420&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=38420&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=38420&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=38420&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=38420&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=38420&r=dst IIS Stability: http://bugs.php.net/fix.php?id=38420&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=38420&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=38420&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=38420&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=38420&r=mysqlcfg