From 754b31bcdf68160acbee368d2ef821df9dbb0271 Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Thu, 4 Sep 2025 18:38:38 +0100
Subject: [PATCH 1/3] Fix GH-19705: do not flush/write buffer on non writeable
 stream.

---
 main/streams/streams.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/main/streams/streams.c b/main/streams/streams.c
index 1471c98558e1..0d72d6512a54 100644
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -1279,6 +1279,10 @@ static ssize_t _php_stream_write_filtered(php_stream *stream, const char *buf, s
 PHPAPI int _php_stream_flush(php_stream *stream, int closing)
 {
 	int ret = 0;
+	if (stream->ops->write == NULL) {
+		php_error_docref(NULL, E_NOTICE, "Stream is not writable");
+		return 0;
+	}
 
 	if (stream->writefilters.head) {
 		_php_stream_write_filtered(stream, NULL, 0, closing ? PSFS_FLAG_FLUSH_CLOSE : PSFS_FLAG_FLUSH_INC );

From de5e14046710623048c11cb44ac391d4671bd60e Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Thu, 4 Sep 2025 18:53:06 +0100
Subject: [PATCH 2/3] add test

---
 ext/standard/tests/streams/gh19705.phpt | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 ext/standard/tests/streams/gh19705.phpt

diff --git a/ext/standard/tests/streams/gh19705.phpt b/ext/standard/tests/streams/gh19705.phpt
new file mode 100644
index 000000000000..fcaa9599d38c
--- /dev/null
+++ b/ext/standard/tests/streams/gh19705.phpt
@@ -0,0 +1,12 @@
+--TEST--
+GH-19705 segmentation fault with non writable stream at stream_filter_append call.
+--EXTENSIONS--
+zlib
+--FILE--
+<?php
+$fh = fopen('data://text/plain,', 'w+',);
+$v_249671 = stream_filter_append($fh, 'zlib.deflate',2,);
+?>
+--EXPECTF--
+
+Notice: PHP Request Shutdown: Stream is not writable in Unknown on line %d

From 883c04ff9c348e136e08ab82d186ee761369e01f Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Wed, 1 Oct 2025 23:51:46 +0100
Subject: [PATCH 3/3] review

---
 ext/standard/tests/streams/gh19705.phpt | 5 ++---
 main/streams/streams.c                  | 6 +-----
 2 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/ext/standard/tests/streams/gh19705.phpt b/ext/standard/tests/streams/gh19705.phpt
index fcaa9599d38c..d34cfc700596 100644
--- a/ext/standard/tests/streams/gh19705.phpt
+++ b/ext/standard/tests/streams/gh19705.phpt
@@ -5,8 +5,7 @@ zlib
 --FILE--
 <?php
 $fh = fopen('data://text/plain,', 'w+',);
-$v_249671 = stream_filter_append($fh, 'zlib.deflate',2,);
+var_dump(stream_filter_append($fh, 'zlib.deflate',STREAM_FILTER_WRITE));
 ?>
 --EXPECTF--
-
-Notice: PHP Request Shutdown: Stream is not writable in Unknown on line %d
+resource(%d) of type (stream filter)
diff --git a/main/streams/streams.c b/main/streams/streams.c
index 0d72d6512a54..fbe689b54153 100644
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -1279,12 +1279,8 @@ static ssize_t _php_stream_write_filtered(php_stream *stream, const char *buf, s
 PHPAPI int _php_stream_flush(php_stream *stream, int closing)
 {
 	int ret = 0;
-	if (stream->ops->write == NULL) {
-		php_error_docref(NULL, E_NOTICE, "Stream is not writable");
-		return 0;
-	}
 
-	if (stream->writefilters.head) {
+	if (stream->writefilters.head && stream->ops->write) {
 		_php_stream_write_filtered(stream, NULL, 0, closing ? PSFS_FLAG_FLUSH_CLOSE : PSFS_FLAG_FLUSH_INC );
 	}