php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #75931 User stream filter is used after destruction
Submitted: 2018-02-07 16:58 UTC Modified: -
From: ivo at beerntea dot com Assigned:
Status: Open Package: Streams related
PHP Version: 7.2.2 OS: Linux x64
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2018-02-07 16:58 UTC] ivo at beerntea dot com
Description:
------------
A php_user_filter instance may be used by PHP's I/O functions after it (and anything it references) has been destructed. This happens when the stream the filter is bound to is closed while the process is exiting.

Allowing the stream to be garbage collected before the process exits (uncomment `$out = NULL;` in the example below) fixes the destruction issue, but still leaves the last (closing) call to the filter method with an invalid stream resource.

Manually closing the stream while it is still referenced results in correct behavior: the final filter call has a valid stream resource and destruction happens after the final call.

Also note that the constructor method is never called. It might be unexpected that an object can be created without its constructor getting called.

This is just a simplified test case. I was implementing a gzip stream filter (with gzip header), using the deflate_init/deflate_add methods when I ran into this problem. The deflate resource stored in a property is also cleaned up before the final filter call happens, so there is no opportunity to finalize the output.

Test script:
---------------
<?php
class test_filter extends php_user_filter {
  public function __construct() {
    fprintf(STDERR, "filter construct\n");
  }
  public function onCreate() {
    fprintf(STDERR, "filter onCreate\n");
  }
  public function filter($in, $out, &$consumed, $closing) {
    fprintf(STDERR, "filter consumed=$consumed closing=".($closing ? 'true' : 'false')." stream valid=".(is_resource($this->stream) ? 'true' : 'false')."\n");
    while ($bucket = stream_bucket_make_writeable($in)) {
      $consumed += $bucket->datalen;
      stream_bucket_append($out, $bucket);
    }
    return PSFS_PASS_ON;
  }
  public function onClose() {
    fprintf(STDERR, "filter onClose\n");
  }
  public function __destruct() {
    fprintf(STDERR, "filter destruct\n");
  }
}

stream_filter_register('test_filter', 'test_filter');

$in = fopen('php://stdin', 'r');
$out = fopen('php://stdout', 'w');
stream_filter_append($out, 'test_filter', STREAM_FILTER_WRITE, array());
stream_copy_to_stream($in, $out);

//fclose($out);
//$out = NULL;


Expected result:
----------------
filter construct
filter onCreate
filter consumed=0 closing=false stream valid=true
hello world
filter consumed=0 closing=true stream valid=true
filter onClose
filter destruct


Actual result:
--------------
filter onCreate
filter consumed=0 closing=false stream valid=true
hello world
filter destruct
filter consumed=0 closing=true stream valid=false
filter onClose


Patches

Add a Patch

Pull Requests

Add a Pull Request

 
PHP Copyright © 2001-2019 The PHP Group
All rights reserved.
Last updated: Sun Aug 18 05:01:28 2019 UTC