[standard] Fix crash when filter callback unsets StreamBucket::$data

stream_bucket_prepend()/append() assumed a successful zend_read_property()
of StreamBucket::$data always yields a string, but for an unset typed
property it throws while returning &EG(uninitialized_zval), so
Z_STRLEN_P() dereferenced a NULL string pointer and crashed when the
brigade was consumed. Reject non-string reads up front (rethrowing any
pending exception) so the bucket is never re-attached with undefined
data; the sibling $bucket property path is already safe because
zend_fetch_resource_ex() rejects non-resources.

Author: iliaal

NEWS

@@ -48,6 +48,8 @@ PHP                                                                        NEWS
     with no other live PDO handle. (iliaal)
 
 - Standard:
+  . Fixed a segfault when a stream filter callback unsets StreamBucket::$data
+    before re-attaching the bucket. (iliaal)
   . Fixed a memory leak in array_merge_recursive() when the recursive merge of
     an object converted to an array fails. (David Carlier)
 

ext/standard/tests/filters/bucket_data_unset.phpt

@@ -0,0 +1,27 @@
+--TEST--
+unset(StreamBucket::$data) in filter callback must not crash when bucket is re-attached
+--FILE--
+<?php
+class MyFilter extends php_user_filter {
+    public function filter($in, $out, &$consumed, bool $closing): int {
+        while ($bucket = stream_bucket_make_writeable($in)) {
+            unset($bucket->data);
+            stream_bucket_prepend($out, $bucket);
+        }
+        return PSFS_PASS_ON;
+    }
+}
+stream_filter_register("myfilter", "MyFilter");
+$fp = fopen("php://temp", "w+");
+fwrite($fp, str_repeat("A", 100));
+rewind($fp);
+stream_filter_append($fp, "myfilter");
+try {
+    var_dump(stream_get_contents($fp));
+} catch (Error $e) {
+    printf("%s: %s\n", get_class($e), $e->getMessage());
+}
+echo "DONE\n";
+--EXPECT--
+Error: Typed property StreamBucket::$data must not be accessed before initialization
+DONE

ext/standard/user_filters.c

@@ -424,6 +424,12 @@ static void php_stream_bucket_attach(int append, INTERNAL_FUNCTION_PARAMETERS)
 
 	if (NULL != (pzdata = zend_read_property(NULL, Z_OBJ_P(zobject), "data", sizeof("data")-1, false, &rv))) {
 		ZVAL_DEREF(pzdata);
+		if (Z_TYPE_P(pzdata) != IS_STRING) {
+			if (!EG(exception)) {
+				zend_argument_value_error(2, "must have a string \"data\" property");
+			}
+			RETURN_THROWS();
+		}
 		if (!bucket->own_buf) {
 			bucket = php_stream_bucket_make_writeable(bucket);
 		}