Bug #81294 [Opn->Ver]: Segfault when removing a filter

Edit report at https://bugs.php.net/bug.php?id=81294&edit=1 ID: 81294 Updated by: requinix@php.net Reported by: ivo dot andonov at gmail dot com Summary: Segfault when removing a filter -Status: Open +Status: Verified Type: Bug Package: Filter related Operating System: Linux / Windows PHP Version: 8.0.8 Block user comment: N Private report: N New Comment: https://github.com/php/php-src/blob/PHP-8.0.8/main/streams/filter.c#L419 Given that the definition of fops->filter is php_stream_filter_status_t (*filter)( php_stream *stream, php_stream_filter *thisfilter, php_stream_bucket_brigade *buckets_in, php_stream_bucket_brigade *buckets_out, size_t *bytes_consumed, int flags ); it does seem odd to call with "thisfilter" as something different. Previous Comments: ------------------------------------------------------------------------ [2021-07-25 19:13:37] ivo dot andonov at gmail dot com Description: ------------ This one seems to be sourced back since quite some time (at least from 5.6.30 till 8.0.8). Right now I do not have the time for posting too many details but it should be pretty clear to understand by looking at streams/filter.c, function _php_stream_filter_flush, then the loop with current = filter and then referencing filter->fops->filter() instead of current->fops->filter(). Test script: --------------- class some_user_filter { ... } stream_filter_register("some.filter", "some_user_filter"); $f = fopen("test", "wb"); $flt1 = stream_filter_append($f, "zlib.deflate", STREAM_FILTER_WRITE); $flt2 = stream_filter_append($f, "some.filter", STREAM_FILTER_WRITE); fwrite($f, "test"); stream_filter_remove($flt1); // this line will fail and at the end of the script a segfault / or MS Don't send / access violation fwrite($f, "test"1); ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=81294&edit=1