archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 13:38:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.4'

Browse source 
* PHP-8.4:
  Fix GH-17139: Fix zip_entry_name() crash on invalid entry
This commit is contained in:
Niels Dossche 2025-01-12 20:42:59 +01:00
commit f99d62013b
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
3 changed files with 24 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
ext/zip/php_zip.c
View file

@ -1261,6 +1261,7 @@ PHP_FUNCTION(zip_read)
RETURN_FALSE; RETURN_FALSE;
} }
zr_rsrc->zip_rsrc_handle = Z_RES_P(zip_dp)->handle;
zr_rsrc->zf = zip_fopen_index(rsrc_int->za, rsrc_int->index_current, 0); zr_rsrc->zf = zip_fopen_index(rsrc_int->za, rsrc_int->index_current, 0);
if (zr_rsrc->zf) { if (zr_rsrc->zf) {
rsrc_int->index_current++; rsrc_int->index_current++;
@ -1377,7 +1378,7 @@ static void php_zip_entry_get_info(INTERNAL_FUNCTION_PARAMETERS, int opt) /* {{{
RETURN_THROWS(); RETURN_THROWS();
} }
if (!zr_rsrc->zf) { if (!zr_rsrc->zf || !zend_hash_index_exists(&EG(regular_list), zr_rsrc->zip_rsrc_handle)) {
RETURN_FALSE; RETURN_FALSE;
} }

3
ext/zip/php_zip.h
View file

@ -60,6 +60,9 @@ typedef zip_rsrc * zip_rsrc_ptr;
typedef struct _ze_zip_read_rsrc { typedef struct _ze_zip_read_rsrc {
struct zip_file *zf; struct zip_file *zf;
struct zip_stat sb; struct zip_stat sb;
/* Used to check if the zip resource still exists,
* without holding a reference. This works because the IDs are unique. */
zend_long zip_rsrc_handle;
} zip_read_rsrc; } zip_read_rsrc;
/* Extends zend object */ /* Extends zend object */

19
ext/zip/tests/gh17319.phpt Normal file
View file

@ -0,0 +1,19 @@
--TEST--
GH-17139 - zip_entry_name() crash
--EXTENSIONS--
zip
--FILE--
<?php
$zip = zip_open(__DIR__."/test_procedural.zip");
if (!is_resource($zip)) die("Failure");
// no need to bother looping over, the entry name should point to a dangling address from the first iteration
$zip = zip_read($zip);
var_dump(zip_entry_name($zip));
?>
--EXPECTF--
Deprecated: Function zip_open() is deprecated since 8.0, use ZipArchive::open() instead in %s on line %d
Deprecated: Function zip_read() is deprecated since 8.0, use ZipArchive::statIndex() instead in %s on line %d
Deprecated: Function zip_entry_name() is deprecated since 8.0, use ZipArchive::statIndex() instead in %s on line %d
bool(false)