[php-src] PR #23564: Discard buckets abandoned by a filter that returns no output

From: Date: Fri, 04 Sep 2026 12:14:46 +0000
Subject: [php-src] PR #23564: Discard buckets abandoned by a filter that returns no output
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-38297@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/23564 Author: iliaal A user filter can append buckets to its $out brigade and still answer PSFS_FEED_ME or PSFS_ERR_FATAL. Both brigades live on the caller's stack frame, so whatever is left on them when the caller returns leaks with bucket->brigade dangling, and re-appending such a bucket later writes through that pointer. php_stream_fill_read_buffer() and php_stream_filter_append_ex() already discard leftovers; _php_stream_filter_flush() returned without touching either brigade, and _php_stream_write_filtered() drained only the input one. Smallest case is a filter that appends one bucket to $out, returns PSFS_ERR_FATAL, and is then passed to stream_filter_remove().

« previous php.git-pulls (#38297) next »