Edited documents cannot be saved when using encryption (server-side)

This seems similar to #781 but I'm still having issues and that's listed as closed. I'm currently running 16.0.8 with php 7.3 on apache2 on Debian 9 with collaboraonline packages v6.2.10 and loolwsd 4.2.0. This has worked fine until recently. I don't know which update broke the functionality.

If I open a file that I've created before, it opens and I can see it. If I make any change at all and attempt to save it I get "Failed to read document from storage. Please contact your storage server (<mydomain>) administrator."

I can also create a file and open it fine, and can edit it, but again, it fails to save with the same error.

Any time thereafter, I cannot open any file I attempted to edit as it fails with the same message. I attempted to rollback to 3.5.0 with no success.

I've duplicated this behavior on Vivaldi (Chrome) and Firefox.

Here's the nextcloud logs from opening a file I can see (haven't edited):

{"reqId":"33YEjSzXGqz7oBO8YrBE","level":0,"time":"2020-02-19T14:02:59+00:00","remoteAddr":"<server ip>","user":"--","app":"richdocuments","method":"GET","url":"\/index.php\/apps\/richdocuments\/wopi\/files\/41888_5127bcd54d75c?access_token=e5MqjzmozWPmshbfbyIz2EOzRYP6kDhN&access_token_ttl=0","message":"Loaded WOPI Token record: {\"id\":\"235\",\"owner_uid\":\"<myuser>\",\"editor_uid\":\"<myuser>\",\"fileid\":\"41888\",\"version\":\"0\",\"canwrite\":\"1\",\"server_host\":\"https:\/\/<mydomain>\/\",\"token\":\"e5MqjzmozWPmshbfbyIz2EOzRYP6kDhN\",\"expiry\":\"1582122777\",\"guest_displayname\":null,\"template_destination\":\"0\",\"hide_download\":\"0\",\"direct\":\"0\",\"is_remote_token\":\"0\",\"remote_server\":\"\",\"remote_server_token\":\"\",\"template_id\":\"0\"}.","userAgent":"LOOLWSD WOPI Agent 4.2.0","version":"16.0.8.1"}
{"reqId":"qjnOto3JzdJZk50IjFuZ","level":0,"time":"2020-02-19T14:02:59+00:00","remoteAddr":"<server ip>","user":"--","app":"richdocuments","method":"GET","url":"\/index.php\/apps\/richdocuments\/wopi\/files\/41888_5127bcd54d75c\/contents?access_token=e5MqjzmozWPmshbfbyIz2EOzRYP6kDhN&access_token_ttl=0","message":"Loaded WOPI Token record: {\"id\":\"235\",\"owner_uid\":\"<myuser>\",\"editor_uid\":\"<myuser>\",\"fileid\":\"41888\",\"version\":\"0\",\"canwrite\":\"1\",\"server_host\":\"https:\/\/<mydomain>\/\",\"token\":\"e5MqjzmozWPmshbfbyIz2EOzRYP6kDhN\",\"expiry\":\"1582122777\",\"guest_displayname\":null,\"template_destination\":\"0\",\"hide_download\":\"0\",\"direct\":\"0\",\"is_remote_token\":\"0\",\"remote_server\":\"\",\"remote_server_token\":\"\",\"template_id\":\"0\"}.","userAgent":"LOOLWSD WOPI Agent 4.2.0","version":"16.0.8.1"}

Here's the nextcloud log for a file I cannot open:

{"reqId":"q2gfWUOrgwaoquuqcPGc","level":3,"time":"2020-02-19T14:03:31+00:00","remoteAddr":"<workstation ip>","user":"<myuser>","app":"PHP","method":"GET","url":"\/index.php\/apps\/richdocuments\/index?fileId=111012&requesttoken=1ZZCpGN1EPRTxq3ffZqT6zyX0%2FBrDxCf6fw929yhxts%3D%3A5ud17y42WKYZh9eHTKzgoW%2FClcUedmnKg8RV4rfi%2Fqs%3D","message":"fread(): Length parameter must be greater than 0 at \/var\/www\/nextcloud\/apps\/files_external\/3rdparty\/icewind\/streams\/src\/Wrapper.php#91","userAgent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko\/20100101 Firefox\/72.0","version":"16.0.8.1"}
{"reqId":"ou1yO2GWveE8UWa7DAhu","level":0,"time":"2020-02-19T14:03:32+00:00","remoteAddr":"<server ip>","user":"--","app":"richdocuments","method":"GET","url":"\/index.php\/apps\/richdocuments\/wopi\/files\/111012_5127bcd54d75c?access_token=EF2RmY0H3nGCraxsqV70YtZ4xoUmbMcI&access_token_ttl=0","message":"Loaded WOPI Token record: {\"id\":\"236\",\"owner_uid\":\"<myuser>\",\"editor_uid\":\"<myuser>\",\"fileid\":\"111012\",\"version\":\"0\",\"canwrite\":\"1\",\"server_host\":\"https:\/\/<mydomain>\/\",\"token\":\"EF2RmY0H3nGCraxsqV70YtZ4xoUmbMcI\",\"expiry\":\"1582122811\",\"guest_displayname\":null,\"template_destination\":\"0\",\"hide_download\":\"0\",\"direct\":\"0\",\"is_remote_token\":\"0\",\"remote_server\":\"\",\"remote_server_token\":\"\",\"template_id\":\"0\"}.","userAgent":"LOOLWSD WOPI Agent 4.2.0","version":"16.0.8.1"}
{"reqId":"2V4apJqFGclbWrer5XZz","level":0,"time":"2020-02-19T14:03:32+00:00","remoteAddr":"<server ip>","user":"--","app":"richdocuments","method":"GET","url":"\/index.php\/apps\/richdocuments\/wopi\/files\/111012_5127bcd54d75c\/contents?access_token=EF2RmY0H3nGCraxsqV70YtZ4xoUmbMcI&access_token_ttl=0","message":"Loaded WOPI Token record: {\"id\":\"236\",\"owner_uid\":\"<myuser>\",\"editor_uid\":\"<myuser>\",\"fileid\":\"111012\",\"version\":\"0\",\"canwrite\":\"1\",\"server_host\":\"https:\/\/<mydomain>\/\",\"token\":\"EF2RmY0H3nGCraxsqV70YtZ4xoUmbMcI\",\"expiry\":\"1582122811\",\"guest_displayname\":null,\"template_destination\":\"0\",\"hide_download\":\"0\",\"direct\":\"0\",\"is_remote_token\":\"0\",\"remote_server\":\"\",\"remote_server_token\":\"\",\"template_id\":\"0\"}.","userAgent":"LOOLWSD WOPI Agent 4.2.0","version":"16.0.8.1"}
{"reqId":"2V4apJqFGclbWrer5XZz","level":3,"time":"2020-02-19T14:03:33+00:00","remoteAddr":"<server ip>","user":"--","app":"PHP","method":"GET","url":"\/index.php\/apps\/richdocuments\/wopi\/files\/111012_5127bcd54d75c\/contents?access_token=EF2RmY0H3nGCraxsqV70YtZ4xoUmbMcI&access_token_ttl=0","message":"fread(): Length parameter must be greater than 0 at \/var\/www\/nextcloud\/apps\/files_external\/3rdparty\/icewind\/streams\/src\/Wrapper.php#91","userAgent":"LOOLWSD WOPI Agent 4.2.0","version":"16.0.8.1"}

This seems significant:

fread(): Length parameter must be greater than 0 at \/var\/www\/nextcloud\/apps\/files_external\/3rdparty\/icewind\/streams\/src\/Wrapper.php#91

but I don't really know.

Start by reproducing the save and reopen failure with server-side encryption, then inspect files_external/3rdparty/icewind/streams/src/Wrapper.php at line 91 and the richdocuments WOPI /contents requests in the logs. Done means identifying the cause of the zero-length fread and confirming that edited encrypted documents can be saved and reopened.