[php-src] PR #23564: Discard buckets abandoned by a filter that returns no output
| From: | iliaal | Date: | Fri, 04 Sep 2026 12:14:46 +0000 |
| Subject: | [php-src] PR #23564: Discard buckets abandoned by a filter that returns no output | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38297@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23564
Author: iliaal
A user filter can append buckets to its $out brigade and still answer PSFS_FEED_ME or
PSFS_ERR_FATAL. Both brigades live on the caller's stack frame, so whatever is left on them
when the caller returns leaks with bucket->brigade dangling, and re-appending such a bucket later
writes through that pointer. php_stream_fill_read_buffer() and php_stream_filter_append_ex() already
discard leftovers; _php_stream_filter_flush() returned without touching either brigade, and
_php_stream_write_filtered() drained only the input one. Smallest case is a filter that appends one
bucket to $out, returns PSFS_ERR_FATAL, and is then passed to stream_filter_remove().