Commit cb7612f76d2 for php

commit cb7612f76d2a87497a5bc3dc70932c0b08967cca
Merge: 020d4741745 10709b6eabb
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Fri Nov 6 17:04:37 2026 -0500

    Merge branch 'PHP-8.4' into PHP-8.5

    * PHP-8.4:
      Fix GH-22063: Stream filter chain UAF on self-removal during callback

diff --cc NEWS
index 287f2b1d0a4,28e8b7a1888..ac9a1213090
--- a/NEWS
+++ b/NEWS
@@@ -25,7 -23,11 +25,11 @@@ PH
      or never terminates). (Ilia Alshanetsky)
    . Fixed memory leak in JIT ASSIGN_DIM when the assignment fails. (Jorg Sowa)

+ - Streams:
+   . Fixed bug GH-22063 (Stream filter chain UAF on self-removal during
+     callback). (Ilia Alshanetsky)
+
 -19 Nov 2026, PHP 8.4.28
 +19 Nov 2026, PHP 8.5.13

  - Core:
    . Fixed bug GH-24184 (System ID not being reinitialized after an Apache
diff --cc main/streams/streams.c
index 9b3c51149a5,615ff04361a..648e1bda3d8
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@@ -1280,7 -1283,9 +1284,9 @@@ static ssize_t _php_stream_write_filter
  		php_stream_bucket_append(&brig_in, bucket);
  	}

+ 	uint32_t orig_no_remove = stream->flags & PHP_STREAM_FLAG_NO_WRITE_FILTER_REMOVE;
+ 	stream->flags |= PHP_STREAM_FLAG_NO_WRITE_FILTER_REMOVE;
 -	for (filter = stream->writefilters.head; filter; filter = filter->next) {
 +	for (php_stream_filter *filter = stream->writefilters.head; filter; filter = filter->next) {
  		/* for our return value, we are interested in the number of bytes consumed from
  		 * the first filter in the chain */
  		status = filter->fops->filter(stream, filter, brig_inp, brig_outp,