[php-src] master: Merge branch 'PHP-8.4' into PHP-8.5

Author: Weilin Du (LamentXU123) Date: 2026-10-10T03:46:30+08:00 Commit: https://github.com/php/php-src/commit/4cf3ed94a8e14f7f1ce46a293923319a87b9965e Raw diff: https://github.com/php/php-src/commit/4cf3ed94a8e14f7f1ce46a293923319a87b9965e.diff Merge branch 'PHP-8.4' into PHP-8.5 * PHP-8.4: Fix use-after-free when removing a failing zlib.inflate filter (#24176) Changed paths: A ext/zlib/tests/zlib_filter_inflate_error_handler_removes_filter.phpt M NEWS M ext/zlib/zlib_filter.c Diff: diff --git a/NEWS b/NEWS index 3a3c4ff57fc8..a6ef04ca537e 100644 --- a/NEWS +++ b/NEWS @@ -37,6 +37,10 @@ PHP NEWS is called from a progress or cancel callback during close(). (Ilia Alshanetsky) +- Zlib: + . Fixed use-after-free when an error handler removes a failing zlib.inflate + filter (GH-24176). (Edmond) + 22 Oct 2026, PHP 8.5.12 - BCMath: diff --git a/ext/zlib/tests/zlib_filter_inflate_error_handler_removes_filter.phpt b/ext/zlib/tests/zlib_filter_inflate_error_handler_removes_filter.phpt new file mode 100644 index 000000000000..ee5bab1052fc --- /dev/null +++ b/ext/zlib/tests/zlib_filter_inflate_error_handler_removes_filter.phpt @@ -0,0 +1,30 @@ +--TEST-- +zlib.inflate filter removed by the error handler of its own notice +--EXTENSIONS-- +zlib +--FILE-- +<?php +$fp = fopen('php://memory', 'w+'); +$filter = stream_filter_append($fp, 'zlib.inflate', STREAM_FILTER_WRITE); +set_error_handler(function (int $errno, string $errstr) use (&$filter) { + echo $errstr, "\n"; + var_dump(stream_filter_remove($filter)); + return true; +}); +var_dump(fwrite($fp, "\xff\xff\xff\xff")); + +$fp = fopen('php://memory', 'w+'); +fwrite($fp, "\xff\xff\xff\xff"); +rewind($fp); +$filter = stream_filter_append($fp, 'zlib.inflate', STREAM_FILTER_READ); +var_dump(fread($fp, 10)); +echo "Done\n"; +?> +--EXPECT-- +fwrite(): zlib: data error +bool(true) +bool(false) +fread(): zlib: data error +bool(true) +bool(false) +Done diff --git a/ext/zlib/zlib_filter.c b/ext/zlib/zlib_filter.c index e5491afec391..85711be8caa1 100644 --- a/ext/zlib/zlib_filter.c +++ b/ext/zlib/zlib_filter.c @@ -90,11 +90,12 @@ static php_stream_filter_status_t php_zlib_inflate_filter( exit_status = PSFS_PASS_ON; } else if (status != Z_OK && status != Z_BUF_ERROR) { /* Something bad happened */ - php_error_docref(NULL, E_NOTICE, "zlib: %s", zError(status)); php_stream_bucket_delref(bucket); /* reset these because despite the error the filter may be used again */ data->strm.next_in = data->inbuf; data->strm.avail_in = 0; + /* Last: an error handler may remove this filter and free data. */ + php_error_docref(NULL, E_NOTICE, "zlib: %s", zError(status)); return PSFS_ERR_FATAL; } desired -= data->strm.avail_in; /* desired becomes what we consumed this round through */