[GIT-PULLS] [php-src] PR #23466: Fix crash when filter callback unsets StreamBucket::$data
[email protected] (iliaal)
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/23466 Author: iliaal stream_bucket_prepend() and stream_bucket_append() assumed a successful zend_read_property() of StreamBucket::$data always yields a string, but when the property has been unset in the filter callback the read throws while returning &EG(uninitialized_zval), so Z_STRLEN_P() dereferenced a NULL string pointer and crashed once the brigade was consumed. Non-string reads are now rejected up front with the pending exception rethrown, so a bucket is never re-attached with undefined data; the sibling $bucket property path is already safe because zend_fetch_resource_ex() rejects non-resources.