Fix use-after-free when pclose() closes a stream from its user filter

fclose() refuses a stream marked PHP_STREAM_FLAG_NO_FCLOSE, which a user
filter's callback sets on its stream; pclose() closed it anyway, freeing the
stream and the filter under the running callback.

Closes GH-24175

Author: EdmondDantes

NEWS

@@ -28,6 +28,8 @@ PHP                                                                        NEWS
     callback). (Ilia Alshanetsky)
   . Fixed leaks and data loss when user filter leaves buckets on input
     brigade. (ndossche, Matthias Goergens, Jakub Zelenka)
+  . Fixed bug GH-24175 (Use-after-free when pclose() closes a stream from its
+    user filter). (Edmond)
 
 19 Nov 2026, PHP 8.4.28
 

ext/standard/file.c

@@ -851,6 +851,11 @@ PHP_FUNCTION(pclose)
 
 	PHP_STREAM_FROM_ZVAL(stream, res);
 
+	if ((stream->flags & PHP_STREAM_FLAG_NO_FCLOSE) != 0) {
+		php_error_docref(NULL, E_WARNING, ZEND_LONG_FMT " is not a valid stream resource", stream->res->handle);
+		RETURN_LONG(-1);
+	}
+
 	FG(pclose_wait) = 1;
 	zend_list_close(stream->res);
 	FG(pclose_wait) = 0;

ext/standard/tests/filters/pclose_in_filter.phpt

@@ -0,0 +1,28 @@
+--TEST--
+pclose() of the stream from its user filter's callback
+--FILE--
+<?php
+class Closer extends php_user_filter {
+    public function filter($in, $out, &$consumed, bool $closing): int {
+        global $fp;
+        if (!$closing) {
+            var_dump(pclose($fp));
+        }
+        while ($bucket = stream_bucket_make_writeable($in)) {
+            $consumed += $bucket->datalen;
+            stream_bucket_append($out, $bucket);
+        }
+        return PSFS_PASS_ON;
+    }
+}
+
+stream_filter_register('closer', 'Closer');
+$fp = fopen('php://memory', 'w+');
+stream_filter_append($fp, 'closer', STREAM_FILTER_WRITE);
+fwrite($fp, 'abc');
+var_dump(pclose($fp));
+?>
+--EXPECTF--
+Warning: pclose(): %d is not a valid stream resource in %s on line %d
+int(-1)
+int(0)