Fixed bug #35916 (Duplicate calls to stream_bucket_append() lead to a crash).

NEWS

@@ -10,6 +10,8 @@ PHP                                                                        NEWS
 - Fixed segfault/leak in imagecolormatch(). (Pierre)
 - Fixed small leak in mysqli_stmt_fetch() when bound variable was empty string.
   (Andrey)
+- Fixed bug #35916 (Duplicate calls to stream_bucket_append() lead to a crash).
+  (Ilia)
 - Fixed bug #35908 (curl extension uses undefined GCRY_THREAD_OPTIONS_USER).
   (Ilia)
 - Fixed bug #35907 (PDO_OCI uses hardcoded lib path $ORACLE_HOME/lib). (Tony)

ext/standard/tests/filters/bug35916.phpt

@@ -0,0 +1,42 @@
+--TEST--
+Bug #35916 (Duplicate calls to stream_bucket_append() lead to a crash)
+--FILE--
+<?php
+$file = dirname(__FILE__) . "/bug35916.txt";
+@unlink($file);
+
+class strtoupper_filter extends php_user_filter
+{
+        function filter($in, $out, &$consumed, $closing)
+        {
+		while($bucket=stream_bucket_make_writeable($in)) {
+			$bucket->data = strtoupper($bucket->data);
+			$consumed += $bucket->datalen;
+			stream_bucket_append($out, $bucket);
+			stream_bucket_append($out, $bucket);
+                }
+		return PSFS_PASS_ON;
+        }
+	function onCreate()
+	{
+		echo "fffffffffff\n";
+	}
+	function onClose()
+	{
+		echo "hello\n";
+	}
+}
+
+stream_filter_register("strtoupper", "strtoupper_filter");
+$fp=fopen($file, "w");
+stream_filter_append($fp,  "strtoupper");
+fread($fp, 1024);
+fwrite($fp, "Thank you\n");
+fclose($fp);
+readfile($file);
+unlink($file);
+?>
+--EXPECT--
+fffffffffff
+hello
+THANK YOU

main/streams/filter.c

@@ -204,6 +204,10 @@ PHPAPI void php_stream_bucket_prepend(php_stream_bucket_brigade *brigade, php_st
 
 PHPAPI void php_stream_bucket_append(php_stream_bucket_brigade *brigade, php_stream_bucket *bucket TSRMLS_DC)
 {
+	if (brigade->tail == bucket) {
+		return;
+	}
+
 	bucket->prev = brigade->tail;
 	bucket->next = NULL;