Also deny filter removal during a seek() callback

php_stream_filters_seek walks the filter chain calling filter->fops->seek
without raising the chain in_iteration counter, so a user filter whose
seek() method removes itself frees the filter mid-walk and the subsequent
filter->next / userfilter_seek property write are use-after-free. Bracket
the seek loop the same way as the other chain walks so a self-removal
during a seek() callback is denied instead of freeing the live filter.

Author: iliaal

ext/standard/tests/streams/gh22063_seek.phpt

@@ -0,0 +1,34 @@
+--TEST--
+GH-22063 (stream filter self-removal denied during a seek() callback)
+--FILE--
+<?php
+class SeekRemover extends php_user_filter {
+    public function filter($in, $out, &$consumed, $closing): int {
+        while ($b = stream_bucket_make_writeable($in)) {
+            stream_bucket_append($out, $b);
+        }
+        return PSFS_PASS_ON;
+    }
+    public function seek(int $offset, int $whence, int $chain): bool {
+        // Removing the filter that is mid-seek must be denied, not a UAF.
+        var_dump(stream_filter_remove($GLOBALS['f']));
+        return true;
+    }
+}
+stream_filter_register('seekremover', SeekRemover::class);
+
+$fp = fopen('php://memory', 'r+');
+fwrite($fp, 'hello world data here');
+rewind($fp);
+$GLOBALS['f'] = stream_filter_append($fp, 'seekremover', STREAM_FILTER_READ);
+var_dump(fread($fp, 4));
+var_dump(fseek($fp, 0));
+echo "done\n";
+?>
+--EXPECTF--
+string(4) "hell"
+
+Warning: stream_filter_remove(): Cannot remove filter while it is being applied in %s on line %d
+bool(false)
+int(0)
+done

main/streams/streams.c

@@ -1385,17 +1385,27 @@ static bool php_stream_are_filters_seekable(php_stream_filter *filter, bool is_s
 static zend_result php_stream_filters_seek(php_stream *stream, php_stream_filter *filter,
 		bool is_start_seeking, zend_off_t offset, int whence, int chain_type)
 {
+	php_stream_filter_chain *chain = filter ? filter->chain : NULL;
+	if (chain) {
+		chain->in_iteration++;
+	}
 	while (filter) {
 		php_stream_filter_seekable_t seekable = (chain_type == PHP_STREAM_FILTER_READ) ?
 				filter->read_seekable : filter->write_seekable;
 		if (((seekable == PSFS_SEEKABLE_START && is_start_seeking) ||
 				seekable == PSFS_SEEKABLE_CHECK) &&
 				filter->fops->seek(stream, filter, offset, whence) == FAILURE) {
 			php_error_docref(NULL, E_WARNING, "Stream filter seeking for %s failed", filter->fops->label);
+			if (chain) {
+				chain->in_iteration--;
+			}
 			return FAILURE;
 		}
 		filter = filter->next;
 	}
+	if (chain) {
+		chain->in_iteration--;
+	}
 	return SUCCESS;
 }