From 7a14d9c2f79b924c8f5478f26666a3d0dc8fe9f7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bernd=20Holzm=C3=BCller?= <bernd@quarxconnect.de>
Date: Sat, 9 Apr 2022 17:49:36 +0200
Subject: [PATCH 1/2] Added test if php://temp preserves file-pointer when
 switched to temporary file

---
 .../tests/streams/temp_stream_seek.phpt       | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 ext/standard/tests/streams/temp_stream_seek.phpt

diff --git a/ext/standard/tests/streams/temp_stream_seek.phpt b/ext/standard/tests/streams/temp_stream_seek.phpt
new file mode 100644
index 0000000000000..821c6b2784d7d
--- /dev/null
+++ b/ext/standard/tests/streams/temp_stream_seek.phpt
@@ -0,0 +1,20 @@
+--TEST--
+BUG: php://temp does not preserve file-pointer once it switches from memory to temporary file
+--FILE--
+<?php
+
+$f = fopen('php://temp/maxmemory:1024', 'r+');
+fwrite($f, str_repeat("1", 738));
+fseek($f, 0, SEEK_SET);
+fwrite($f, str_repeat("2", 512));
+
+fseek($f, 0, SEEK_SET);
+var_dump(fread($f, 16));
+
+fseek($f, 0, SEEK_END);
+var_dump(ftell($f));
+
+?>
+--EXPECT--
+string(16) "2222222222222222"
+int(738)

From 39a90bc25bb9e50ec19948d33da6d77dcc739741 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bernd=20Holzm=C3=BCller?= <bernd@quarxconnect.de>
Date: Sat, 9 Apr 2022 17:49:47 +0200
Subject: [PATCH 2/2] Preserve file-position when php://temp switches to
 temporary file

---
 main/streams/memory.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/main/streams/memory.c b/main/streams/memory.c
index 0def3b1a3d752..3d09d6d086ccc 100644
--- a/main/streams/memory.c
+++ b/main/streams/memory.c
@@ -375,10 +375,11 @@ static ssize_t php_stream_temp_write(php_stream *stream, const char *buf, size_t
 		return -1;
 	}
 	if (php_stream_is(ts->innerstream, PHP_STREAM_IS_MEMORY)) {
-		size_t memsize;
-		char *membuf = php_stream_memory_get_buffer(ts->innerstream, &memsize);
-
-		if (memsize + count >= ts->smax) {
+		zend_off_t pos = php_stream_tell(ts->innerstream);
+		
+		if (pos + count >= ts->smax) {
+			size_t memsize;
+			char *membuf = php_stream_memory_get_buffer(ts->innerstream, &memsize);
 			php_stream *file = php_stream_fopen_temporary_file(ts->tmpdir, "php", NULL);
 			if (file == NULL) {
 				php_error_docref(NULL, E_WARNING, "Unable to create temporary file, Check permissions in temporary files directory.");
@@ -388,6 +389,7 @@ static ssize_t php_stream_temp_write(php_stream *stream, const char *buf, size_t
 			php_stream_free_enclosed(ts->innerstream, PHP_STREAM_FREE_CLOSE);
 			ts->innerstream = file;
 			php_stream_encloses(stream, ts->innerstream);
+			php_stream_seek(ts->innerstream, pos, SEEK_SET);
 		}
 	}
 	return php_stream_write(ts->innerstream, buf, count);