From 175afc408543c06f8933cc1b1b7f1d5f327a22de Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Thu, 4 Sep 2025 18:38:38 +0100
Subject: [PATCH] Fix GH-19705: do not flush/write buffer on non writeable
 stream.

Co-authored-by: Jakub Zelenka <bukka@php.net>

close GH-19708
---
 NEWS                                    |  2 ++
 ext/standard/tests/streams/gh19705.phpt | 11 +++++++++++
 main/streams/streams.c                  |  2 +-
 3 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 ext/standard/tests/streams/gh19705.phpt

diff --git a/NEWS b/NEWS
index 36da15cf32b..0e2726e14b5 100644
--- a/NEWS
+++ b/NEWS
@@ -57,6 +57,8 @@ PHP                                                                        NEWS
   . Fixed bug GH-19248 (Use strerror_r instead of strerror in main).
     (Jakub Zelenka)
   . Fixed bug GH-17345 (Bug #35916 was not completely fixed). (nielsdos)
+  . Fixed bug GH-19705 (segmentation when attempting to flush on non seekable
+    stream. (bukka/David Carlier)
 
 - XMLReader:
   . Fixed bug GH-20009 (XMLReader leak on RelaxNG schema failure). (nielsdos)
diff --git a/ext/standard/tests/streams/gh19705.phpt b/ext/standard/tests/streams/gh19705.phpt
new file mode 100644
index 00000000000..d34cfc70059
--- /dev/null
+++ b/ext/standard/tests/streams/gh19705.phpt
@@ -0,0 +1,11 @@
+--TEST--
+GH-19705 segmentation fault with non writable stream at stream_filter_append call.
+--EXTENSIONS--
+zlib
+--FILE--
+<?php
+$fh = fopen('data://text/plain,', 'w+',);
+var_dump(stream_filter_append($fh, 'zlib.deflate',STREAM_FILTER_WRITE));
+?>
+--EXPECTF--
+resource(%d) of type (stream filter)
diff --git a/main/streams/streams.c b/main/streams/streams.c
index 46fd85e05e3..11eed3e80c6 100644
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -1295,7 +1295,7 @@ PHPAPI int _php_stream_flush(php_stream *stream, int closing)
 {
 	int ret = 0;
 
-	if (stream->writefilters.head) {
+	if (stream->writefilters.head && stream->ops->write) {
 		_php_stream_write_filtered(stream, NULL, 0, closing ? PSFS_FLAG_FLUSH_CLOSE : PSFS_FLAG_FLUSH_INC );
 	}