Fixed bug #72535 arcfour encryption stream filter crashes php

Author: weltling

ext/mcrypt/mcrypt_filter.c

@@ -89,7 +89,7 @@ static php_stream_filter_status_t php_mcrypt_filter(
 			php_stream_bucket_delref(bucket TSRMLS_CC);
 		} else {
 			/* Stream cipher */
-			php_stream_bucket_make_writeable(bucket TSRMLS_CC);
+			bucket = php_stream_bucket_make_writeable(bucket TSRMLS_CC);
 			if (data->encrypt) {
 				mcrypt_generic(data->module, bucket->buf, bucket->buflen);
 			} else {

ext/mcrypt/tests/bug72535.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #72535 arcfour encryption stream filter crashes php
+--SKIPIF--
+<?php if (!extension_loaded("mcrypt")) print "skip"; ?>
+--FILE--
+<?php
+$passphrase = 'My secret';
+$plaintext = 'Secret secret secret data';
+
+$iv = substr(md5('iv' . $passphrase, true), 0, 8);
+$key = substr(md5('pass1' . $passphrase, true) .
+	              md5('pass2' . $passphrase, true), 0, 24);
+$opts = array('iv' => $iv, 'key' => $key, 'mode' => 'stream');
+
+$expected = substr($plaintext . $plaintext, 0, 48);
+
+$fp = fopen('php://memory', 'wb+');
+stream_filter_append($fp, 'mcrypt.arcfour', STREAM_FILTER_WRITE, $opts);
+fwrite($fp, $plaintext);
+?>
+==NOCRASH==
+--EXPECT--
+==NOCRASH==