Fix GH-20370: forbid user stream filters to violate typed property constraints

NEWS

@@ -81,6 +81,8 @@ PHP                                                                        NEWS
 - Streams:
   . Fixed bug GH-19798: XP_SOCKET XP_SSL (Socket stream modules): Incorrect
     condition for Win32/Win64. (Jakub Zelenka)
+  . Fixed bug GH-20370 (User stream filters could violate typed property
+    constraints). (alexandre-daubois)
 
 - Tidy:
   . Fixed GH-19021 (improved tidyOptGetCategory detection).

ext/standard/tests/filters/gh20370.phpt

@@ -0,0 +1,44 @@
+--TEST--
+GH-20370 (User filters should respect typed properties)
+--FILE--
+<?php
+
+class pass_filter
+{
+    public $filtername;
+    public $params;
+    public int $stream = 1;
+
+    function filter($in, $out, &$consumed, $closing): int
+    {
+        while ($bucket = stream_bucket_make_writeable($in)) {
+            $consumed += $bucket->datalen;
+            stream_bucket_append($out, $bucket);
+        }
+        return PSFS_PASS_ON;
+    }
+}
+
+stream_filter_register("pass", "pass_filter");
+$fp = fopen("php://memory", "w");
+stream_filter_append($fp, "pass");
+
+try {
+    fwrite($fp, "data");
+} catch (TypeError $e) {
+    echo "Threw TypeError on fwrite\n";
+}
+
+try {
+    fclose($fp);
+} catch (TypeError $e) {
+    echo "Threw TypeError on fclose\n";
+}
+
+unset($fp); // prevent cleanup at shutdown
+
+?>
+--EXPECTF--
+Warning: fwrite(): Unprocessed filter buckets remaining on input brigade in %s on line %d
+Threw TypeError on fwrite
+Threw TypeError on fclose

ext/standard/tests/filters/gh20370_dynamic_stream_property.phpt

@@ -0,0 +1,51 @@
+--TEST--
+GH-20370 (User filters should update dynamic stream property if it exists)
+--FILE--
+<?php
+
+#[\AllowDynamicProperties]
+class pass_filter
+{
+    public $filtername;
+    public $params;
+
+    function onCreate(): bool
+    {
+        $this->stream = null;
+        return true;
+    }
+
+    function filter($in, $out, &$consumed, $closing): int
+    {
+        while ($bucket = stream_bucket_make_writeable($in)) {
+            $consumed += $bucket->datalen;
+            stream_bucket_append($out, $bucket);
+        }
+        var_dump(property_exists($this, 'stream'));
+        if (is_resource($this->stream)) {
+            var_dump(get_resource_type($this->stream));
+        }
+        return PSFS_PASS_ON;
+    }
+}
+
+stream_filter_register("pass", "pass_filter");
+$fp = fopen("php://memory", "w");
+stream_filter_append($fp, "pass");
+
+fwrite($fp, "data");
+rewind($fp);
+echo fread($fp, 1024) . "\n";
+
+?>
+--EXPECTF--
+bool(true)
+string(6) "stream"
+bool(true)
+string(6) "stream"
+bool(true)
+string(6) "stream"
+bool(true)
+string(6) "stream"
+data
+bool(true)

ext/standard/tests/filters/gh20370_no_stream_property.phpt

@@ -0,0 +1,37 @@
+--TEST--
+GH-20370 (User filters should not create stream property if not declared)
+--FILE--
+<?php
+
+class pass_filter
+{
+    public $filtername;
+    public $params;
+
+    function filter($in, $out, &$consumed, $closing): int
+    {
+        while ($bucket = stream_bucket_make_writeable($in)) {
+            $consumed += $bucket->datalen;
+            stream_bucket_append($out, $bucket);
+        }
+
+        var_dump(property_exists($this, 'stream'));
+        return PSFS_PASS_ON;
+    }
+}
+
+stream_filter_register("pass", "pass_filter");
+$fp = fopen("php://memory", "w");
+stream_filter_append($fp, "pass");
+fwrite($fp, "data");
+rewind($fp);
+echo fread($fp, 1024) . "\n";
+
+?>
+--EXPECT--
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+data
+bool(false)

ext/standard/user_filters.c

@@ -147,12 +147,22 @@ php_stream_filter_status_t userfilter_filter(
 	uint32_t orig_no_fclose = stream->flags & PHP_STREAM_FLAG_NO_FCLOSE;
 	stream->flags |= PHP_STREAM_FLAG_NO_FCLOSE;
 
-	zval *stream_prop = zend_hash_str_find_ind(Z_OBJPROP_P(obj), "stream", sizeof("stream")-1);
-	if (stream_prop) {
-		/* Give the userfilter class a hook back to the stream */
-		zval_ptr_dtor(stream_prop);
-		php_stream_to_zval(stream, stream_prop);
-		Z_ADDREF_P(stream_prop);
+	/* Give the userfilter class a hook back to the stream */
+	zend_property_info *prop_info = zend_hash_str_find_ptr(&Z_OBJCE_P(obj)->properties_info, "stream", sizeof("stream")-1);
+
+	if (prop_info) {
+		/* Declared property (may be uninitialized typed property): always update */
+		zval stream_zval;
+		php_stream_to_zval(stream, &stream_zval);
+		zend_update_property(Z_OBJCE_P(obj), Z_OBJ_P(obj), "stream", sizeof("stream")-1, &stream_zval);
+	} else {
+		/* Check if it's a dynamic property */
+		zval *stream_prop = zend_hash_str_find(Z_OBJPROP_P(obj), "stream", sizeof("stream")-1);
+		if (stream_prop) {
+			zval stream_zval;
+			php_stream_to_zval(stream, &stream_zval);
+			zend_update_property(Z_OBJCE_P(obj), Z_OBJ_P(obj), "stream", sizeof("stream")-1, &stream_zval);
+		}
 	}
 
 	ZVAL_STRINGL(&func_name, "filter", sizeof("filter")-1);
@@ -196,8 +206,20 @@ php_stream_filter_status_t userfilter_filter(
 	/* filter resources are cleaned up by the stream destructor,
 	 * keeping a reference to the stream resource here would prevent it
 	 * from being destroyed properly */
-	if (stream_prop) {
-		convert_to_null(stream_prop);
+	if (prop_info) {
+		/* Declared property, find the actual value to clean it up */
+		zval *stream_prop = zend_hash_str_find(Z_OBJPROP_P(obj), "stream", sizeof("stream")-1);
+		if (stream_prop) {
+			/* Use direct manipulation to avoid type checking during cleanup.
+			 * We need to break the resource reference regardless of property type constraints. */
+			convert_to_null(stream_prop);
+		}
+	} else {
+		/* Dynamic property existence should be checked */
+		zval *stream_prop = zend_hash_str_find(Z_OBJPROP_P(obj), "stream", sizeof("stream")-1);
+		if (stream_prop) {
+			convert_to_null(stream_prop);
+		}
 	}
 
 	zval_ptr_dtor(&args[3]);