[php-src] PR #23466: Fix crash when filter callback unsets StreamBucket::$data
| From: | iliaal | Date: | Tue, 25 Aug 2026 23:24:15 +0000 |
| Subject: | [php-src] PR #23466: Fix crash when filter callback unsets StreamBucket::$data | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38147@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23466
Author: iliaal
stream_bucket_prepend() and stream_bucket_append() assumed a successful zend_read_property() of
StreamBucket::$data always yields a string, but when the property has been unset in the filter
callback the read throws while returning &EG(uninitialized_zval), so Z_STRLEN_P() dereferenced a
NULL string pointer and crashed once the brigade was consumed. Non-string reads are now rejected up
front with the pending exception rethrown, so a bucket is never re-attached with undefined data; the
sibling $bucket property path is already safe because zend_fetch_resource_ex() rejects
non-resources.