[php-src] Issue #22397: UAF when user stream filter removes itself

[email protected] (iluuu1994) Mon, 22 Jun 2026 14:00:12 +0000
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/22397
Author: iluuu1994

### Description

Originally reported by @pucagit.

The following code:

```php
<?php

class FilterTrigger extends php_user_filter {
    public static $filter = null;

    public function filter($in, $out, &$consumed, bool $closing): int {
        if (self::$filter !== null) {
            $fr = self::$filter;
            self::$filter = null;
            @stream_filter_remove($fr);
        }
        return PSFS_PASS_ON;
    }

    public function onCreate(): bool { return true; }
    public function onClose(): void {}
}

stream_filter_register('filterT', 'FilterTrigger');
$f = fopen('/dev/null', 'r');
FilterTrigger::$filter = stream_filter_append($f, 'filterT', STREAM_FILTER_READ);
fread($f, 4);
@fclose($f);
```

Resulted in this output:
```
=================================================================
==77100==ERROR: AddressSanitizer: heap-use-after-free on address 0x7371be1e3028 at pc 0x603bc6749577 bp 0x7ffcb719e1b0 sp 0x7ffcb719e1a8
READ of size 8 at 0x7371be1e3028 thread T0
    #0 0x603bc6749576 in userfilter_filter /home/ilutov/Developer/php-src/ext/standard/user_filters.c:245
    #1 0x603bc69324b1 in _php_stream_fill_read_buffer /home/ilutov/Developer/php-src/main/streams/streams.c:454
    #2 0x603bc69366ea in _php_stream_read /home/ilutov/Developer/php-src/main/streams/streams.c:625
    #3 0x603bc6936f2f in php_stream_read_to_str /home/ilutov/Developer/php-src/main/streams/streams.c:673
    #4 0x603bc653cfa7 in zif_fread /home/ilutov/Developer/php-src/ext/standard/file.c:1626
    #5 0x603bc6e3aeee in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /home/ilutov/Developer/php-src/Zend/zend_vm_execute.h:1322
    #6 0x603bc70e079d in execute_ex /home/ilutov/Developer/php-src/Zend/zend_vm_execute.h:110447
    #7 0x603bc70fde12 in zend_execute /home/ilutov/Developer/php-src/Zend/zend_vm_execute.h:115646
    #8 0x603bc738eb9f in zend_execute_script /home/ilutov/Developer/php-src/Zend/zend.c:1972
    #9 0x603bc6887feb in php_execute_script_ex /home/ilutov/Developer/php-src/main/main.c:2655
    #10 0x603bc6888698 in php_execute_script /home/ilutov/Developer/php-src/main/main.c:2695
    #11 0x603bc73971e2 in do_cli /home/ilutov/Developer/php-src/sapi/cli/php_cli.c:947
    #12 0x603bc739af6c in main /home/ilutov/Developer/php-src/sapi/cli/php_cli.c:1370
    #13 0x76f1bf22b284 in __libc_start_call_main (/nix/store/57iz36553175g3178pvxjij8z5rcsd4n-glibc-2.42-61/lib/libc.so.6+0x2b284) (BuildId: 8ae0b698f2d4e727f569f64bb166e08ae30bd077)
    #14 0x76f1bf22b337 in __libc_start_main@GLIBC_2.2.5 (/nix/store/57iz36553175g3178pvxjij8z5rcsd4n-glibc-2.42-61/lib/libc.so.6+0x2b337) (BuildId: 8ae0b698f2d4e727f569f64bb166e08ae30bd077)
    #15 0x603bc5202af4 in _start (/home/ilutov/Developer/php-src/sapi/cli/php+0x3202af4)
```

But I expected this output instead:
```
```


### PHP Version

```plain
PHP 8.4+
```

### Operating System

_No response_