Fix unchecked brigade flatten errors in apache2handler

php_apache_sapi_read_post() checks ap_get_brigade() errors but ignores the return value of apr_brigade_flatten().

If a bucket read fails during flattening, APR returns before updating the supplied length. The callback then counts the requested length as successfully read, potentially reporting bytes that were not written into the destination buffer.

Apache's core input filter normally reads socket buckets and propagates errors through ap_get_brigade(), so ordinary network failures are already handled. This change defensively handles any bucket-read failure occurring during the subsequent flatten operation; no such failure has been demonstrated with the standard input-filter chain.

Check the flatten result after cleaning up the brigade and return zero on failure, matching the existing handling of ap_get_brigade() errors. Successful reads are unchanged.

Assisted-by: Copilot:gpt-6.1-sol

Author: joshtrichards

sapi/apache2handler/sapi_apache2.c

@@ -195,8 +195,13 @@ php_apache_sapi_read_post(char *buf, size_t count_bytes)
 	 */
 
 	while ((status = ap_get_brigade(r->input_filters, brigade, AP_MODE_READBYTES, APR_BLOCK_READ, len)) == APR_SUCCESS) {
-		apr_brigade_flatten(brigade, buf, &len);
+		status = apr_brigade_flatten(brigade, buf, &len);
 		apr_brigade_cleanup(brigade);
+
+		if (status != APR_SUCCESS) {
+			return 0;
+		}
+
 		tlen += len;
 		if (tlen == count_bytes || !len) {
 			break;