realloc with size 0 in user_filters.c

[chongwick]

Description

The following code:

<?php
class testfilter extends php_user_filter {
  function filter($in, $out, &$consumed, $closing): int {
    while ($bucket = stream_bucket_make_writeable($in)) {
      $bucket->data = preg_replace('/.(?<!^)/m', '', strtoupper($bucket->data));
      $consumed += strlen($bucket->data);
      stream_bucket_append($out, $bucket);
    }
    return PSFS_PASS_ON;
  }

  function oncreate(): bool {
    echo "params: {$this->params}\n";
    return true;
  }
}

stream_filter_register('testfilter','testfilter');

$text = "Hello There!";

$fp = tmpfile();
fwrite($fp, $text);

rewind($fp);
stream_filter_append($fp, 'testfilter', STREAM_FILTER_READ, 'testuserfilter');

while ($line = fgets($fp)) {
    assertArrayEquals(["Hello"], explode(" ", $line));
}

fclose($fp);

Resulted in this output:

php-src/ext/standard/user_filters.c:408:3: runtime error: null pointer passed as argument 1, which is declared to never be null

USE_ZEND_ALLOC=0 php test.php

PHP Version

nightly

Operating System

ubuntu 22.04