Fix phpGH-23898: Keep user_filter_map alive until streams are closed

BG(user_filter_map) was destroyed in the user_filters RSHUTDOWN, while the
matching factories in FG(stream_filters) survive until
php_shutdown_stream_hashes(). Streams are only closed later in
zend_deactivate(), so a filter() callback running at that point could
call stream_filter_register() and stream_filter_append() with the two
tables out of sync, recreating a leaked map and hitting ZEND_ASSERT(ce)
or a NULL class entry dereference.

Free the map in a post-deactivate hook of the basic module instead, which
runs after the executor is gone and no PHP callback can run anymore. This
also covers phpGH-22449 and phpGH-22818, whose tests now expect the shutdown
registration and append to succeed.

Author: bukka

NEWS

@@ -67,6 +67,10 @@ PHP                                                                        NEWS
 
 - Opcache:
   . Fix zend_analyze_calls() call_stack buffer overrun. (Mrmaxmeier)
+
+- Standard:
+  . Fixed bug GH-23898 (stream_filter_register() during shutdown leads to
+    assertion failure or crash in user_filter_factory_create()). (Jakub Zelenka)
   . Fixed bug GH-23679 (Tracing JIT writes a parent private property into a
     child's shadowing public property). (Ilia Alshanetsky)
   . Fix multiple incorrect DCE due to unsound escape analysis. (ndossche,

ext/standard/basic_functions.c

@@ -156,7 +156,7 @@ zend_module_entry basic_functions_module = { /* {{{ */
 	PHP_MINFO(basic),			/* extension info */
 	PHP_STANDARD_VERSION,		/* extension version */
 	NO_MODULE_GLOBALS,
-	ZEND_MODULE_POST_ZEND_DEACTIVATE_N(streams),
+	ZEND_MODULE_POST_ZEND_DEACTIVATE_N(basic),
 	STANDARD_MODULE_PROPERTIES_EX
 };
 /* }}} */
@@ -475,7 +475,6 @@ PHP_RSHUTDOWN_FUNCTION(basic) /* {{{ */
 		BG(user_tick_functions) = NULL;
 	}
 
-	BASIC_RSHUTDOWN_SUBMODULE(user_filters)
 	BASIC_RSHUTDOWN_SUBMODULE(browscap)
 
 	/* Free last http headers */
@@ -487,6 +486,14 @@ PHP_RSHUTDOWN_FUNCTION(basic) /* {{{ */
 }
 /* }}} */
 
+ZEND_MODULE_POST_ZEND_DEACTIVATE_D(basic) /* {{{ */
+{
+	ZEND_MODULE_POST_ZEND_DEACTIVATE_N(user_filters)();
+
+	return ZEND_MODULE_POST_ZEND_DEACTIVATE_N(streams)();
+}
+/* }}} */
+
 PHP_MINFO_FUNCTION(basic) /* {{{ */
 {
 	php_info_print_table_start();

ext/standard/basic_functions.h

@@ -38,13 +38,14 @@ PHP_MINIT_FUNCTION(basic);
 PHP_MSHUTDOWN_FUNCTION(basic);
 PHP_RINIT_FUNCTION(basic);
 PHP_RSHUTDOWN_FUNCTION(basic);
+ZEND_MODULE_POST_ZEND_DEACTIVATE_D(basic);
 PHP_MINFO_FUNCTION(basic);
 
 ZEND_API void php_get_highlight_struct(zend_syntax_highlighter_ini *syntax_highlighter_ini);
 
 PHP_MINIT_FUNCTION(poll);
 PHP_MINIT_FUNCTION(user_filters);
-PHP_RSHUTDOWN_FUNCTION(user_filters);
+ZEND_MODULE_POST_ZEND_DEACTIVATE_D(user_filters);
 PHP_RSHUTDOWN_FUNCTION(browscap);
 
 PHPAPI zend_result _php_error_log(int opt_err, const zend_string *message, const zend_string *opt, const zend_string *headers);

ext/standard/tests/gh22449.phpt

@@ -5,10 +5,17 @@ Bug GH-22449: user_filter_factory_create NULL dereference during shutdown
 
 class rotate_filter_nw extends php_user_filter
 {
+    private static bool $done = false;
+
     public function filter($in, $out, &$consumed, $closing): int
     {
+        if (self::$done) {
+            return PSFS_PASS_ON;
+        }
+        self::$done = true;
+
         $stream = fopen('php://memory', 'w+');
-        stream_filter_append($stream, "rotator_notWorking");
+        var_dump(stream_filter_append($stream, "rotator_notWorking") !== false);
 
         return PSFS_PASS_ON;
     }
@@ -21,7 +28,6 @@ stream_filter_append($stream, "rotator_notWorking");
 
 echo "done\n";
 ?>
---EXPECTF--
+--EXPECT--
 done
-
-Warning: stream_filter_append(): Unable to create or locate filter "rotator_notWorking" in %s on line %d
+bool(true)

ext/standard/tests/gh22818.phpt

@@ -5,11 +5,18 @@ Bug GH-22818: user_filter_factory_create assertion failure on shutdown re-regist
 
 class rotate_filter_nw extends php_user_filter
 {
+    private static bool $done = false;
+
     public function filter($in, $out, &$consumed, $closing): int
     {
+        if (self::$done) {
+            return PSFS_PASS_ON;
+        }
+        self::$done = true;
+
         $stream = fopen('php://memory', 'w+');
-        stream_filter_register("rotator_notWorking", rotate_filter_nw::class);
-        stream_filter_append($stream, "rotator_notWorking");
+        var_dump(stream_filter_register("rotator_notWorking", rotate_filter_nw::class));
+        var_dump(stream_filter_append($stream, "rotator_notWorking") !== false);
 
         return PSFS_PASS_ON;
     }
@@ -22,7 +29,7 @@ stream_filter_append($stream, "rotator_notWorking");
 
 echo "done\n";
 ?>
---EXPECTF--
+--EXPECT--
 done
-
-Warning: stream_filter_append(): Unable to create or locate filter "rotator_notWorking" in %s on line %d
+bool(false)
+bool(true)

ext/standard/tests/gh23898.phpt

@@ -0,0 +1,37 @@
+--TEST--
+Bug GH-23898: user_filter_factory_create assertion failure on shutdown registration of a new filter
+--FILE--
+<?php
+
+class shutdown_filter extends php_user_filter
+{
+    private static bool $done = false;
+
+    public function filter($in, $out, &$consumed, $closing): int
+    {
+        if (self::$done) {
+            return PSFS_PASS_ON;
+        }
+        self::$done = true;
+
+        $stream = fopen('php://memory', 'w+');
+        var_dump(stream_filter_register("shutdown_filter_other", shutdown_filter::class));
+        var_dump(stream_filter_append($stream, "shutdown_filter") !== false);
+        var_dump(stream_filter_append($stream, "shutdown_filter_other") !== false);
+
+        return PSFS_PASS_ON;
+    }
+}
+
+stream_filter_register("shutdown_filter", shutdown_filter::class);
+
+$stream = fopen('php://memory', 'w+');
+stream_filter_append($stream, "shutdown_filter");
+
+echo "done\n";
+?>
+--EXPECT--
+done
+bool(true)
+bool(true)
+bool(true)

ext/standard/user_filters.c

@@ -95,7 +95,9 @@ PHP_MINIT_FUNCTION(user_filters)
 	return SUCCESS;
 }
 
-PHP_RSHUTDOWN_FUNCTION(user_filters)
+/* Freed post-deactivate rather than in RSHUTDOWN, as streams closed during
+ * executor shutdown may still create user filters from their callbacks. */
+ZEND_MODULE_POST_ZEND_DEACTIVATE_D(user_filters)
 {
 	if (BG(user_filter_map)) {
 		zend_hash_destroy(BG(user_filter_map));
@@ -605,8 +607,8 @@ PHP_FUNCTION(stream_filter_register)
 		RETURN_THROWS();
 	}
 
-	/* Register the factory first; if that fails, don't (re)create the map,
-	 * which would leak during shutdown re-registration. */
+	/* Register the factory first so that a duplicate name is rejected before
+	 * the map is touched; the map and FG(stream_filters) must stay in sync. */
 	if (php_stream_filter_register_factory_volatile(filtername, &user_filter_factory) == FAILURE) {
 		RETURN_FALSE;
 	}