|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #81294 Segfault when removing a filter
Submitted: 2021-07-25 19:13 UTC Modified: 2021-07-26 11:59 UTC
From: ivo dot andonov at gmail dot com Assigned: cmb (profile)
Status: Closed Package: Streams related
PHP Version: 7.4 OS: Linux / Windows
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please !
Your email address:
Solve the problem:
37 - 12 = ?
Subscribe to this entry?

 [2021-07-25 19:13 UTC] ivo dot andonov at gmail dot com
This one seems to be sourced back since quite some time (at least from 5.6.30 till 8.0.8). Right now I do not have the time for posting too many details but it should be pretty clear to understand by looking at streams/filter.c, function _php_stream_filter_flush, then the loop with current = filter and then referencing filter->fops->filter() instead of current->fops->filter().

Test script:
class some_user_filter {
stream_filter_register("some.filter", "some_user_filter");
$f = fopen("test", "wb");
$flt1 = stream_filter_append($f, "zlib.deflate", STREAM_FILTER_WRITE);
$flt2 = stream_filter_append($f, "some.filter", STREAM_FILTER_WRITE);
fwrite($f, "test");
stream_filter_remove($flt1); // this line will fail and at the end of the script a segfault / or MS Don't send / access violation
fwrite($f, "test"1);


Add a Patch

Pull Requests

Pull requests:

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2021-07-25 20:21 UTC]
-Status: Open +Status: Verified
 [2021-07-25 20:21 UTC]

Given that the definition of fops->filter is

php_stream_filter_status_t (*filter)(
  php_stream *stream,
  php_stream_filter *thisfilter,
  php_stream_bucket_brigade *buckets_in,
  php_stream_bucket_brigade *buckets_out,
  size_t *bytes_consumed,
  int flags

it does seem odd to call with "thisfilter" as something different.
 [2021-07-26 11:58 UTC]
-PHP Version: 8.0.8 +PHP Version: 7.4 -Assigned To: +Assigned To: cmb
 [2021-07-26 11:59 UTC]
-Package: Filter related +Package: Streams related
 [2021-07-26 11:59 UTC]
Changing to "Streams related", since "Filter related" is often
misused for ext/filter.
 [2021-07-26 12:13 UTC]
The following pull request has been associated:

Patch Name: Fix #81294: Segfault when removing a filter
On GitHub:
 [2021-07-27 10:17 UTC]
Automatic comment on behalf of cmb69
Log: Fix #81294: Segfault when removing a filter
 [2021-07-27 10:17 UTC]
-Status: Verified +Status: Closed
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Wed Jun 19 21:01:29 2024 UTC