Merge branch 'PHP-8.3' into PHP-8.4

* PHP-8.3:
  Fix phpGH-17650: realloc with size 0 in user_filters.c

Author: ndossche

NEWS

@@ -43,6 +43,9 @@ PHP                                                                        NEWS
   . Partially fixed bug GH-17387 (Trivial crash in phpdbg lexer). (nielsdos)
   . Fix memory leak in phpdbg calling registered function. (nielsdos)
 
+- Streams:
+  . Fixed bug GH-17650 (realloc with size 0 in user_filters.c). (nielsdos)
+
 30 Jan 2025, PHP 8.4.4
 
 - Core:

ext/standard/tests/streams/gh17650.phpt

@@ -0,0 +1,35 @@
+--TEST--
+GH-17650 (realloc with size 0 in user_filters.c)
+--FILE--
+<?php
+class testfilter extends php_user_filter {
+  function filter($in, $out, &$consumed, $closing): int {
+    while ($bucket = stream_bucket_make_writeable($in)) {
+      $bucket->data = '';
+      $consumed += strlen($bucket->data);
+      stream_bucket_append($out, $bucket);
+    }
+    return PSFS_PASS_ON;
+  }
+}
+
+stream_filter_register('testfilter','testfilter');
+
+$text = "Hello There!";
+
+$fp = fopen('php://memory', 'w+');
+fwrite($fp, $text);
+
+rewind($fp);
+stream_filter_append($fp, 'testfilter', STREAM_FILTER_READ, 'testuserfilter');
+
+while ($x = fgets($fp)) {
+  var_dump($x);
+}
+
+fclose($fp);
+
+echo "Done\n";
+?>
+--EXPECT--
+Done

ext/standard/user_filters.c

@@ -402,7 +402,7 @@ static void php_stream_bucket_attach(int append, INTERNAL_FUNCTION_PARAMETERS)
 			bucket = php_stream_bucket_make_writeable(bucket);
 		}
 		if (bucket->buflen != Z_STRLEN_P(pzdata)) {
-			bucket->buf = perealloc(bucket->buf, Z_STRLEN_P(pzdata), bucket->is_persistent);
+			bucket->buf = perealloc(bucket->buf, MAX(Z_STRLEN_P(pzdata), 1), bucket->is_persistent);
 			bucket->buflen = Z_STRLEN_P(pzdata);
 		}
 		memcpy(bucket->buf, Z_STRVAL_P(pzdata), bucket->buflen);