Fix heap overflow when a read filter changes the stream's chunk size

_php_stream_fill_read_buffer() allocates chunk_buf from stream->chunk_size
once, but read each chunk with the current stream->chunk_size. A read filter
that calls stream_set_chunk_size() on its stream, directly or from code that
runs while the filter's Fiber is suspended, makes the next read write past
chunk_buf. The size is now taken once for the whole loop.

Author: EdmondDantes

ext/standard/tests/streams/stream_set_chunk_size_in_read_filter.phpt

@@ -0,0 +1,39 @@
+--TEST--
+stream_set_chunk_size() called by a read filter
+--FILE--
+<?php
+class Grow extends php_user_filter {
+    private int $seen = 0;
+
+    public function filter($in, $out, &$consumed, bool $closing): int {
+        stream_set_chunk_size($this->stream, 4000000);
+
+        while ($bucket = stream_bucket_make_writeable($in)) {
+            $consumed += $bucket->datalen;
+            $this->seen += $bucket->datalen;
+        }
+
+        if ($closing) {
+            stream_bucket_append($out, stream_bucket_new($this->stream, (string) $this->seen));
+            return PSFS_PASS_ON;
+        }
+
+        return PSFS_FEED_ME;
+    }
+}
+
+stream_filter_register('grow', 'Grow');
+
+$file = __DIR__ . '/stream_set_chunk_size_in_read_filter.tmp';
+file_put_contents($file, str_repeat('x', 65536));
+
+$handle = fopen($file, 'r');
+stream_filter_append($handle, 'grow', STREAM_FILTER_READ);
+var_dump(fread($handle, 4096));
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/stream_set_chunk_size_in_read_filter.tmp');
+?>
+--EXPECT--
+string(5) "65536"

main/streams/streams.c

@@ -565,13 +565,14 @@ PHPAPI zend_result _php_stream_fill_read_buffer(php_stream *stream, size_t size)
 	bool old_eof = stream->eof;
 
 	if (stream->readfilters.head) {
-		size_t to_read_now = MIN(size, stream->chunk_size);
+		const size_t chunk_size = stream->chunk_size;
+		size_t to_read_now = MIN(size, chunk_size);
 		char *chunk_buf;
 		php_stream_bucket_brigade brig_in = { NULL, NULL }, brig_out = { NULL, NULL };
 		php_stream_bucket_brigade *brig_inp = &brig_in, *brig_outp = &brig_out, *brig_swap;
 
 		/* allocate a buffer for reading chunks */
-		chunk_buf = emalloc(stream->chunk_size);
+		chunk_buf = emalloc(chunk_size);
 
 		while (!stream->eof && (stream->writepos - stream->readpos < (zend_off_t)to_read_now)) {
 			ssize_t justread = 0;
@@ -581,7 +582,7 @@ PHPAPI zend_result _php_stream_fill_read_buffer(php_stream *stream, size_t size)
 			php_stream_filter *filter;
 
 			/* read a chunk into a bucket */
-			justread = stream->ops->read(stream, chunk_buf, stream->chunk_size);
+			justread = stream->ops->read(stream, chunk_buf, chunk_size);
 			if (justread < 0 && stream->writepos == stream->readpos) {
 				efree(chunk_buf);
 				retval = FAILURE;