MFH: Fixed #46164 (stream_filter_remove() closes the stream)

3 files changed, 55 insertions, 0 deletions

diff --git a/ext/standard/tests/filters/bug46164-1.phpt b/ext/standard/tests/filters/bug46164-1.phpt
new file mode 100644
index 0000000000..b2d2d4e85d
--- /dev/null
+++ b/ext/standard/tests/filters/bug46164-1.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #46164 - 1 (stream_filter_remove() closes the stream)
+--FILE--
+<?php
+class user_filter extends php_user_filter {
+	function filter($in, $out, &$consumed, $closing) {
+		while($bucket = stream_bucket_make_writeable($in)) {
+			$consumed += $bucket->datalen;
+			stream_bucket_append($out, $bucket);
+		}
+		return PSFS_PASS_ON;
+	}
+}
+stream_filter_register('user_filter','user_filter');
+
+$fd = fopen('php://memory','w');
+$filter = stream_filter_append($fd, 'user_filter');
+stream_filter_remove($filter);
+var_dump(fclose($fd));
+?>
+--EXPECT--
+bool(true)
diff --git a/ext/standard/tests/filters/bug46164-2.phpt b/ext/standard/tests/filters/bug46164-2.phpt
new file mode 100644
index 0000000000..6a1bde5962
--- /dev/null
+++ b/ext/standard/tests/filters/bug46164-2.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #46164 - 2 (stream_filter_remove() closes the stream)
+--FILE--
+<?php
+class user_filter extends php_user_filter {
+	function filter($in, $out, &$consumed, $closing) {
+		while($bucket = stream_bucket_make_writeable($in)) {
+			$consumed += $bucket->datalen;
+			stream_bucket_append($out, $bucket);
+		}
+		unset($this->stream);
+		return PSFS_PASS_ON;
+	}
+}
+stream_filter_register('user_filter','user_filter');
+
+$fd = fopen('php://memory','w');
+$filter = stream_filter_append($fd, 'user_filter');
+fwrite($fd, "foo");
+fflush($fd);
+var_dump(fclose($fd));
+?>
+--EXPECT--
+bool(true)
diff --git a/ext/standard/user_filters.c b/ext/standard/user_filters.c
index f470ca28c3..1d16900127 100644
--- a/ext/standard/user_filters.c
+++ b/ext/standard/user_filters.c
@@ -180,12 +180,14 @@ php_stream_filter_status_t userfilter_filter(
 	zval *retval = NULL;
 	zval **args[4];
 	zval *zclosing, *zconsumed, *zin, *zout, *zstream;
+	zval zpropname;
 	int call_result;
 
 	if (FAILURE == zend_hash_find(Z_OBJPROP_P(obj), "stream", sizeof("stream"), (void**)&zstream)) {
 		/* Give the userfilter class a hook back to the stream */
 		ALLOC_INIT_ZVAL(zstream);
 		php_stream_to_zval(stream, zstream);
+		zval_copy_ctor(zstream);
 		add_property_zval(obj, "stream", zstream);
 		/* add_property_zval increments the refcount which is unwanted here */
 		zval_ptr_dtor(&zstream);
@@ -247,6 +249,13 @@ php_stream_filter_status_t userfilter_filter(
 		}
 	}
 
+	/* filter resources are cleaned up by the stream destructor,
+	 * keeping a reference to the stream resource here would prevent it
+	 * from being destroyed properly */
+	INIT_ZVAL(zpropname);
+	ZVAL_STRINGL(&zpropname, "stream", sizeof("stream")-1, 0);
+	Z_OBJ_HANDLER_P(obj, unset_property)(obj, &zpropname TSRMLS_CC);
+
 	zval_ptr_dtor(&zclosing);
 	zval_ptr_dtor(&zconsumed);
 	zval_ptr_dtor(&zout);