From 175afc408543c06f8933cc1b1b7f1d5f327a22de Mon Sep 17 00:00:00 2001 From: David Carlier Date: Thu, 4 Sep 2025 18:38:38 +0100 Subject: [PATCH 1/2] Fix GH-19705: do not flush/write buffer on non writeable stream. Co-authored-by: Jakub Zelenka close GH-19708 --- NEWS | 2 ++ ext/standard/tests/streams/gh19705.phpt | 11 +++++++++++ main/streams/streams.c | 2 +- 3 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 ext/standard/tests/streams/gh19705.phpt diff --git a/NEWS b/NEWS index 36da15cf32b7e..0e2726e14b5d9 100644 --- a/NEWS +++ b/NEWS @@ -57,6 +57,8 @@ PHP NEWS . Fixed bug GH-19248 (Use strerror_r instead of strerror in main). (Jakub Zelenka) . Fixed bug GH-17345 (Bug #35916 was not completely fixed). (nielsdos) + . Fixed bug GH-19705 (segmentation when attempting to flush on non seekable + stream. (bukka/David Carlier) - XMLReader: . Fixed bug GH-20009 (XMLReader leak on RelaxNG schema failure). (nielsdos) diff --git a/ext/standard/tests/streams/gh19705.phpt b/ext/standard/tests/streams/gh19705.phpt new file mode 100644 index 0000000000000..d34cfc700596d --- /dev/null +++ b/ext/standard/tests/streams/gh19705.phpt @@ -0,0 +1,11 @@ +--TEST-- +GH-19705 segmentation fault with non writable stream at stream_filter_append call. +--EXTENSIONS-- +zlib +--FILE-- + +--EXPECTF-- +resource(%d) of type (stream filter) diff --git a/main/streams/streams.c b/main/streams/streams.c index 46fd85e05e35d..11eed3e80c61e 100644 --- a/main/streams/streams.c +++ b/main/streams/streams.c @@ -1295,7 +1295,7 @@ PHPAPI int _php_stream_flush(php_stream *stream, int closing) { int ret = 0; - if (stream->writefilters.head) { + if (stream->writefilters.head && stream->ops->write) { _php_stream_write_filtered(stream, NULL, 0, closing ? PSFS_FLAG_FLUSH_CLOSE : PSFS_FLAG_FLUSH_INC ); } From a3c14d6ab403246ebe310f763bd7d8c7a7fe45cb Mon Sep 17 00:00:00 2001 From: Jakub Zelenka Date: Thu, 2 Oct 2025 13:42:11 +0200 Subject: [PATCH 2/2] Do not use errno_t as it is not defined on musl (#20037) --- main/network.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/main/network.c b/main/network.c index 7102dad20798f..fecec0545e8f0 100644 --- a/main/network.c +++ b/main/network.c @@ -1090,7 +1090,7 @@ PHPAPI char *php_socket_strerror(long err, char *buf, size_t bufsize) char *errstr = strerror_r(err, ebuf, sizeof(ebuf)); buf = estrdup(errstr); # else - errno_t res = strerror_r(err, ebuf, sizeof(ebuf)); + int res = (int) strerror_r(err, ebuf, sizeof(ebuf)); if (res == 0) { buf = estrdup(ebuf); } else { @@ -1101,7 +1101,7 @@ PHPAPI char *php_socket_strerror(long err, char *buf, size_t bufsize) # ifdef STRERROR_R_CHAR_P buf = strerror_r(err, buf, bufsize); # else - errno_t res = strerror_r(err, buf, bufsize); + int res = (int) strerror_r(err, buf, bufsize); if (res != 0) { strncpy(buf, "Unknown error", bufsize); buf[bufsize?(bufsize-1):0] = 0; @@ -1146,7 +1146,7 @@ PHPAPI zend_string *php_socket_error_str(long err) char *errstr = strerror_r(err, ebuf, sizeof(ebuf)); # else const char *errstr; - errno_t res = strerror_r(err, ebuf, sizeof(ebuf)); + int res = (int) strerror_r(err, ebuf, sizeof(ebuf)); if (res == 0) { errstr = ebuf; } else {