From 248be6fcfc7782d9b73e47de5979eea5a7fc0a5e Mon Sep 17 00:00:00 2001
From: Antony Dovgal <tony2001@php.net>
Date: Fri, 23 Dec 2005 14:32:11 +0000
Subject: [PATCH] fix #35781 (stream_filter_append() can cause segfault)

---
 ext/standard/tests/file/bug35781.phpt | 24 ++++++++++++++++++++++++
 main/streams/plain_wrapper.c          |  2 +-
 main/streams/streams.c                |  4 ++--
 3 files changed, 27 insertions(+), 3 deletions(-)
 create mode 100644 ext/standard/tests/file/bug35781.phpt

diff --git a/ext/standard/tests/file/bug35781.phpt b/ext/standard/tests/file/bug35781.phpt
new file mode 100644
index 00000000000..5dc684a65df
--- /dev/null
+++ b/ext/standard/tests/file/bug35781.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #35781 (stream_filter_append() causes segfault)
+--FILE--
+<?php
+
+$filename = dirname(__FILE__)."/bug35781.txt";
+	
+$fp = fopen($filename, "w");
+stream_filter_append($fp, "string.rot13", -49);
+fwrite($fp, "This is a test\n");
+rewind($fp);
+fpassthru($fp);
+fclose($fp);
+
+var_dump(file_get_contents($filename));
+
+@unlink($filename);
+
+echo "Done\n";
+?>
+--EXPECTF--	
+string(15) "Guvf vf n grfg
+"
+Done
diff --git a/main/streams/plain_wrapper.c b/main/streams/plain_wrapper.c
index 83e0e74165f..6af0ba5f06f 100644
--- a/main/streams/plain_wrapper.c
+++ b/main/streams/plain_wrapper.c
@@ -316,7 +316,7 @@ static size_t php_stdiop_read(php_stream *stream, char *buf, size_t count TSRMLS
 	if (data->fd >= 0) {
 		ret = read(data->fd, buf, count);
 		
-		stream->eof = (ret == 0 || (ret == -1 && errno != EWOULDBLOCK));
+		stream->eof = (ret == 0 || (ret == (size_t)-1 && errno != EWOULDBLOCK));
 				
 	} else {
 #if HAVE_FLUSHIO
diff --git a/main/streams/streams.c b/main/streams/streams.c
index 6a3b3848b36..f4d6b2bab1c 100755
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -442,7 +442,7 @@ static void php_stream_fill_read_buffer(php_stream *stream, size_t size TSRMLS_D
 
 			/* read a chunk into a bucket */
 			justread = stream->ops->read(stream, chunk_buf, stream->chunk_size TSRMLS_CC);
-			if (justread > 0) {
+			if (justread != (size_t)-1) {
 				bucket = php_stream_bucket_new(stream, chunk_buf, justread, 0, 0 TSRMLS_CC);
 
 				/* after this call, bucket is owned by the brigade */
@@ -511,7 +511,7 @@ static void php_stream_fill_read_buffer(php_stream *stream, size_t size TSRMLS_D
 					break;
 			}
 
-			if (justread == 0) {
+			if (justread == 0 || justread == (size_t)-1) {
 				break;
 			}
 		}