Merge branch 'PHP-8.2' into PHP-8.3

nielsdos · Nov 17, 2023 · 7abe3fe · 7abe3fe
2 parents 59dcb00 + 4da89d8
commit 7abe3fe
Show file tree

Hide file tree

Showing 7 changed files with 52 additions and 11 deletions.
diff --git a/NEWS b/NEWS
@@ -11,16 +11,20 @@ PHP                                                                        NEWS
 - PHPDBG:
   . Fixed bug GH-12675 (MEMORY_LEAK in phpdbg_prompt.c). (nielsdos)
 
+- SQLite3:
+  . Fixed bug GH-12633 (sqlite3_defensive.phpt fails with sqlite 3.44.0).
+    (SakiTakamachi)
+
 - Standard:
   . Fix memory leak in syslog device handling. (danog)
   . Fixed bug GH-12621 (browscap segmentation fault when configured in the
     vhost). (nielsdos)
   . Fixed bug GH-12655 (proc_open() does not take into account references
     in the descriptor array). (nielsdos)
 
-- SQLite3:
-  . Fixed bug GH-12633 (sqlite3_defensive.phpt fails with sqlite 3.44.0).
-    (SakiTakamachi)
+- Streams:
+  . Fixed bug #79945 (Stream wrappers in imagecreatefrompng causes segfault).
+    (Jakub Zelenka)
 
 - Zip:
   . Fixed bug GH-12661 (Inconsistency in ZipArchive::addGlob remove_path Option

diff --git a/ext/gd/tests/bug79945.phpt b/ext/gd/tests/bug79945.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #79945 (using php wrappers in imagecreatefrompng causes segmentation fault)
+--EXTENSIONS--
+gd
+--SKIPIF--
+<?php
+set_error_handler(function($errno, $errstr) {
+    if (str_contains($errstr, 'Cannot cast a filtered stream on this system')) {
+        die('skip: fopencookie not support on this system');
+    }
+});
+imagecreatefrompng('php://filter/read=convert.base64-encode/resource=' . __DIR__ . '/test.png');
+restore_error_handler();
+?>
+--FILE--
+<?php
+imagecreatefrompng('php://filter/read=convert.base64-encode/resource=' . __DIR__ . '/test.png');
+?>
+--CLEAN--
+--EXPECTF--
+
+Warning: imagecreatefrompng(): "php://filter/read=convert.base64-encode/resource=%s" is not a valid PNG file in %s on line %d
diff --git a/ext/zlib/tests/gzcompress_basic1.phpt b/ext/zlib/tests/gzcompress_basic1.phpt
@@ -2,6 +2,8 @@
 Test gzcompress() function : basic functionality
 --EXTENSIONS--
 zlib
+--SKIPIF--
+<?php if (getenv('TRAVIS')) die('skip Currently fails on Travis'); ?>
 --FILE--
 <?php
 /*

diff --git a/ext/zlib/tests/gzdeflate_basic1.phpt b/ext/zlib/tests/gzdeflate_basic1.phpt
@@ -2,6 +2,8 @@
 Test gzdeflate() function : basic functionality
 --EXTENSIONS--
 zlib
+--SKIPIF--
+<?php if (getenv('TRAVIS')) die('skip Currently fails on Travis'); ?>
 --FILE--
 <?php
 /*

diff --git a/ext/zlib/tests/gzencode_basic1.phpt b/ext/zlib/tests/gzencode_basic1.phpt
@@ -2,6 +2,8 @@
 Test gzencode() function : basic functionality
 --EXTENSIONS--
 zlib
+--SKIPIF--
+<?php if (getenv('TRAVIS')) die('skip Currently fails on Travis'); ?>
 --FILE--
 <?php
 /*

diff --git a/main/php_streams.h b/main/php_streams.h
@@ -207,17 +207,21 @@ struct _php_stream  {
 	void *wrapperthis;		/* convenience pointer for an instance of a wrapper */
 	zval wrapperdata;		/* fgetwrapperdata retrieves this */
 
-	uint8_t is_persistent:1;
-	uint8_t in_free:2;			/* to prevent recursion during free */
-	uint8_t eof:1;
-	uint8_t __exposed:1;	/* non-zero if exposed as a zval somewhere */
+	uint16_t is_persistent:1;
+	uint16_t in_free:2;			/* to prevent recursion during free */
+	uint16_t eof:1;
+	uint16_t __exposed:1;	/* non-zero if exposed as a zval somewhere */
 
 	/* so we know how to clean it up correctly.  This should be set to
 	 * PHP_STREAM_FCLOSE_XXX as appropriate */
-	uint8_t fclose_stdiocast:2;
+	uint16_t fclose_stdiocast:2;
+
 
 	/* flag to mark whether the stream has buffered data */
-	uint8_t has_buffered_data:1;
+	uint16_t has_buffered_data:1;
+
+	/* whether stdio cast flushing is in progress */
+	uint16_t fclose_stdiocast_flush_in_progress:1;
 
 	char mode[16];			/* "rwb" etc. ala stdio */
 

diff --git a/main/streams/streams.c b/main/streams/streams.c
@@ -1322,8 +1322,13 @@ PHPAPI zend_off_t _php_stream_tell(php_stream *stream)
 PHPAPI int _php_stream_seek(php_stream *stream, zend_off_t offset, int whence)
 {
 	if (stream->fclose_stdiocast == PHP_STREAM_FCLOSE_FOPENCOOKIE) {
-		/* flush to commit data written to the fopencookie FILE* */
-		fflush(stream->stdiocast);
+		/* flush can call seek internally so we need to prevent an infinite loop */
+		if (!stream->fclose_stdiocast_flush_in_progress) {
+			stream->fclose_stdiocast_flush_in_progress = 1;
+			/* flush to commit data written to the fopencookie FILE* */
+			fflush(stream->stdiocast);
+			stream->fclose_stdiocast_flush_in_progress = 0;
+		}
 	}
 
 	/* handle the case where we are in the buffer */