From 5dcb8f2f1cd84cab83b7713efcbafeeb629b8b5b Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Tue, 8 Sep 2020 15:09:30 +0200
Subject: Fix #72941: Modifying bucket->data by-ref has no effect any longer

To match the PHP 5 behavior, we have to explicitly cater to `buffer` or
`data` being references.

Closes GH-6096.
---
 NEWS                                     |  2 ++
 ext/standard/tests/filters/bug72941.phpt | 35 ++++++++++++++++++++++++++++++++
 ext/standard/user_filters.c              |  4 ++--
 3 files changed, 39 insertions(+), 2 deletions(-)
 create mode 100644 ext/standard/tests/filters/bug72941.phpt

diff --git a/NEWS b/NEWS
index 6f908fdc5a..40e393d39a 100644
--- a/NEWS
+++ b/NEWS
@@ -26,6 +26,8 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed bug #79986 (str_ireplace bug with diacritics characters). (cmb)
   . Fixed bug #80077 (getmxrr test bug). (Rainer Jung)
+  . Fixed bug #72941 (Modifying bucket->data by-ref has no effect any longer).
+    (cmb)
 
 03 Sep 2020, PHP 7.3.22
 
diff --git a/ext/standard/tests/filters/bug72941.phpt b/ext/standard/tests/filters/bug72941.phpt
new file mode 100644
index 0000000000..464b005079
--- /dev/null
+++ b/ext/standard/tests/filters/bug72941.phpt
@@ -0,0 +1,35 @@
+--TEST--
+Bug #72941 (Modifying bucket->data by-ref has no effect any longer)
+--FILE--
+<?php
+class rotate_filter_nw extends php_user_filter
+{
+    function filter($in, $out, &$consumed, $closing)
+    {
+        while ($bucket = stream_bucket_make_writeable($in)) {
+            $this->rotate($bucket->data);
+            $consumed += $bucket->datalen;
+            stream_bucket_prepend($out, $bucket);
+        }
+
+        return PSFS_PASS_ON;
+    }
+
+    function rotate(&$data)
+    {
+        $n = strlen($data);
+        for ($i = 0; $i < $n - 1; ++$i) {
+            $data[$i] = $data[$i + 1];
+        }
+    }
+}
+
+stream_filter_register("rotator_notWorking", rotate_filter_nw::class);
+$stream = fopen('php://memory', 'w+');
+fwrite($stream, 'hello, world');
+rewind($stream);
+stream_filter_append($stream, "rotator_notWorking");
+var_dump(stream_get_contents($stream));
+?>
+--EXPECT--
+string(12) "ello, worldd"
diff --git a/ext/standard/user_filters.c b/ext/standard/user_filters.c
index 584d055145..030591d36a 100644
--- a/ext/standard/user_filters.c
+++ b/ext/standard/user_filters.c
@@ -434,7 +434,7 @@ static void php_stream_bucket_attach(int append, INTERNAL_FUNCTION_PARAMETERS)
 		Z_PARAM_OBJECT(zobject)
 	ZEND_PARSE_PARAMETERS_END_EX(RETURN_FALSE);
 
-	if (NULL == (pzbucket = zend_hash_str_find(Z_OBJPROP_P(zobject), "bucket", sizeof("bucket")-1))) {
+	if (NULL == (pzbucket = zend_hash_str_find_deref(Z_OBJPROP_P(zobject), "bucket", sizeof("bucket")-1))) {
 		php_error_docref(NULL, E_WARNING, "Object has no bucket property");
 		RETURN_FALSE;
 	}
@@ -448,7 +448,7 @@ static void php_stream_bucket_attach(int append, INTERNAL_FUNCTION_PARAMETERS)
 		RETURN_FALSE;
 	}
 
-	if (NULL != (pzdata = zend_hash_str_find(Z_OBJPROP_P(zobject), "data", sizeof("data")-1)) && Z_TYPE_P(pzdata) == IS_STRING) {
+	if (NULL != (pzdata = zend_hash_str_find_deref(Z_OBJPROP_P(zobject), "data", sizeof("data")-1)) && Z_TYPE_P(pzdata) == IS_STRING) {
 		if (!bucket->own_buf) {
 			bucket = php_stream_bucket_make_writeable(bucket);
 		}
-- 
cgit v1.2.1