Avoid using OBJPROP

Author: alexandre-daubois

ext/standard/tests/filters/gh20370.phpt

@@ -26,15 +26,19 @@ stream_filter_append($fp, "pass");
 try {
     fwrite($fp, "data");
 } catch (TypeError $e) {
-    echo "TypeError: Cannot assign resource to typed property\n";
+    echo "Threw TypeError on fwrite\n";
 }
 
+try {
+    fclose($fp);
+} catch (TypeError $e) {
+    echo "Threw TypeError on fclose\n";
+}
+
+unset($fp); // prevent cleanup at shutdown
+
 ?>
 --EXPECTF--
 Warning: fwrite(): Unprocessed filter buckets remaining on input brigade in %s on line %d
-TypeError: Cannot assign resource to typed property
-
-Fatal error: Uncaught TypeError: Cannot assign resource to property pass_filter::$stream of type int in %s
-Stack trace:
-#0 {main}
-  thrown in %s
+Threw TypeError on fwrite
+Threw TypeError on fclose

ext/standard/user_filters.c

@@ -148,11 +148,21 @@ php_stream_filter_status_t userfilter_filter(
 	stream->flags |= PHP_STREAM_FLAG_NO_FCLOSE;
 
 	/* Give the userfilter class a hook back to the stream */
-	zval *stream_prop = zend_hash_str_find(Z_OBJPROP_P(obj), "stream", sizeof("stream")-1);
-	if (stream_prop) {
+	zend_property_info *prop_info = zend_hash_str_find_ptr(&Z_OBJCE_P(obj)->properties_info, "stream", sizeof("stream")-1);
+
+	if (prop_info) {
+		/* Declared property (may be uninitialized typed property) - always update */
 		zval stream_zval;
 		php_stream_to_zval(stream, &stream_zval);
 		zend_update_property(Z_OBJCE_P(obj), Z_OBJ_P(obj), "stream", sizeof("stream")-1, &stream_zval);
+	} else {
+		/* Check if it's a dynamic property - only access OBJPROP as fallback */
+		zval *stream_prop = zend_hash_str_find(Z_OBJPROP_P(obj), "stream", sizeof("stream")-1);
+		if (stream_prop) {
+			zval stream_zval;
+			php_stream_to_zval(stream, &stream_zval);
+			zend_update_property(Z_OBJCE_P(obj), Z_OBJ_P(obj), "stream", sizeof("stream")-1, &stream_zval);
+		}
 	}
 
 	ZVAL_STRINGL(&func_name, "filter", sizeof("filter")-1);
@@ -196,8 +206,20 @@ php_stream_filter_status_t userfilter_filter(
 	/* filter resources are cleaned up by the stream destructor,
 	 * keeping a reference to the stream resource here would prevent it
 	 * from being destroyed properly */
-	if (stream_prop) {
-		zend_update_property_null(Z_OBJCE_P(obj), Z_OBJ_P(obj), "stream", sizeof("stream")-1);
+	if (prop_info) {
+		/* Declared property - find the actual value to clean it up */
+		zval *stream_prop = zend_hash_str_find(Z_OBJPROP_P(obj), "stream", sizeof("stream")-1);
+		if (stream_prop) {
+			/* Use direct manipulation to avoid type checking during cleanup.
+			 * We need to break the resource reference regardless of property type constraints. */
+			convert_to_null(stream_prop);
+		}
+	} else {
+		/* Dynamic property - check if it exists */
+		zval *stream_prop = zend_hash_str_find(Z_OBJPROP_P(obj), "stream", sizeof("stream")-1);
+		if (stream_prop) {
+			convert_to_null(stream_prop);
+		}
 	}
 
 	zval_ptr_dtor(&args[3]);