archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.3' into PHP-8.4

Browse source 
* PHP-8.3:
  Fix phar crash and file corruption with SplFileObject
This commit is contained in:
Niels Dossche 2025-07-05 21:44:34 +02:00
commit 2aeefb13be
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
5 changed files with 30 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

1
NEWS
View file

@ -44,6 +44,7 @@ PHP NEWS
- Phar: - Phar:
. Fix stream double free in phar. (nielsdos, dixyes) . Fix stream double free in phar. (nielsdos, dixyes)
. Fix phar crash and file corruption with SplFileObject. (nielsdos)
- SOAP: - SOAP:
. Fixed bug GH-18990, bug #81029, bug #47314 (SOAP HTTP socket not closing . Fixed bug GH-18990, bug #81029, bug #47314 (SOAP HTTP socket not closing

2
ext/phar/phar.c
View file

@ -2700,7 +2700,7 @@ void phar_flush_ex(phar_archive_data *phar, zend_string *user_stub, bool is_defa
/* remove this from the new phar */ /* remove this from the new phar */
continue; continue;
} }
if (!entry->is_modified && entry->fp_refcount) { if (entry->fp_refcount) {
/* open file pointers refer to this fp, do not free the stream */ /* open file pointers refer to this fp, do not free the stream */
switch (entry->fp_type) { switch (entry->fp_type) {
case PHAR_FP: case PHAR_FP:

4
ext/phar/stream.c
View file

@ -449,12 +449,12 @@ static ssize_t phar_stream_write(php_stream *stream, const char *buf, size_t cou
{ {
phar_entry_data *data = (phar_entry_data *) stream->abstract; phar_entry_data *data = (phar_entry_data *) stream->abstract;
php_stream_seek(data->fp, data->position, SEEK_SET); php_stream_seek(data->fp, data->position + data->zero, SEEK_SET);
if (count != php_stream_write(data->fp, buf, count)) { if (count != php_stream_write(data->fp, buf, count)) {
php_stream_wrapper_log_error(stream->wrapper, stream->flags, "phar error: Could not write %d characters to \"%s\" in phar \"%s\"", (int) count, data->internal_file->filename, data->phar->fname); php_stream_wrapper_log_error(stream->wrapper, stream->flags, "phar error: Could not write %d characters to \"%s\" in phar \"%s\"", (int) count, data->internal_file->filename, data->phar->fname);
return -1; return -1;
} }
data->position = php_stream_tell(data->fp); data->position = php_stream_tell(data->fp) - data->zero;
if (data->position > (zend_off_t)data->internal_file->uncompressed_filesize) { if (data->position > (zend_off_t)data->internal_file->uncompressed_filesize) {
data->internal_file->uncompressed_filesize = data->position; data->internal_file->uncompressed_filesize = data->position;
} }

2
ext/phar/tar.c
View file

@ -834,7 +834,7 @@ static int phar_tar_writeheaders_int(phar_entry_info *entry, void *argument) /*
php_stream_write(fp->new, padding, ((entry->uncompressed_filesize +511)&~511) - entry->uncompressed_filesize); php_stream_write(fp->new, padding, ((entry->uncompressed_filesize +511)&~511) - entry->uncompressed_filesize);
} }
if (!entry->is_modified && entry->fp_refcount) { if (entry->fp_refcount) {
/* open file pointers refer to this fp, do not free the stream */ /* open file pointers refer to this fp, do not free the stream */
switch (entry->fp_type) { switch (entry->fp_type) {
case PHAR_FP: case PHAR_FP:

25
ext/phar/tests/gh19038.phpt Normal file
View file

@ -0,0 +1,25 @@
--TEST--
GH-19038 (Phar crash and data corruption with SplFileObject)
--EXTENSIONS--
phar
--INI--
phar.readonly=0
--FILE--
<?php
$phar = new Phar(__DIR__ . "/gh19038.phar");
$phar->addFromString("file", "123");
$file = $phar["file"]->openFile();
$file->fseek(3);
var_dump($file->fwrite("456", 3));
$file->fseek(0);
echo $file->fread(100);
?>
--CLEAN--
<?php
@unlink(__DIR__ . "/gh19038.phar");
?>
--EXPECT--
int(3)
123456