Skip to content

Conversation

nielsdos
Copy link
Member

Change the reproducer code in bug35916.phpt from stream_bucket_append to stream_bucket_prepend and you have the same bug. Furthermore, even in the append case the check is incorrect because the bucket can already be in the brigade at a position other than the tail. To solve this properly, unlink the brigade first and also use that as a condition to manage the refcount.

Change the reproducer code in `bug35916.phpt` from `stream_bucket_append` to
`stream_bucket_prepend` and you have the same bug.
Furthermore, even in the append case the check is incorrect because the bucket
can already be in the brigade at a position other than the tail.
To solve this properly, unlink the brigade first and also use that as a
condition to manage the refcount.
@nielsdos nielsdos linked an issue Jun 28, 2025 that may be closed by this pull request
@nielsdos nielsdos marked this pull request as ready for review June 28, 2025 23:36
@nielsdos nielsdos requested a review from bukka as a code owner June 28, 2025 23:36
@nielsdos nielsdos requested a review from arnaud-lb September 30, 2025 19:48
Copy link
Member

@arnaud-lb arnaud-lb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks right to me.

Possibly we should consider this a user error in the future.

@nielsdos nielsdos closed this in 0ffa337 Oct 1, 2025
nielsdos added a commit to nielsdos/php-src that referenced this pull request Oct 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug #35916 was not completely fixed

2 participants