php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-23 16:08:35 +02:00
Code Issues Packages Projects Releases Wiki Activity

Prevent double-free of Phar ZIP stream

Browse Source 
We must not alias the closed stream to `phar_archive_data.fp`, and use
PHAR_ZIP_FAIL() for consistency with the rest of this function.

Closes GH-6578.
This commit is contained in:
Christoph M. Becker
2021-01-05 12:52:00 +01:00
parent afc69e46b8
commit b7689db7ab
2 changed files with 4 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ext/phar/tests/zip/require_hash.phpt
+1 -1
View File
@@ -45,7 +45,7 @@ try {
@unlink(__DIR__ . '/require_hash.zip');
?>
--EXPECTF--
zip-based phar "%srequire_hash.phar.zip" does not have a signature
phar error: signature is missing in zip-based phar "%srequire_hash.phar.zip"
bool(false)
array(2) {
["hash"]=>
ext/phar/zip.c
+3 -8
View File
@@ -665,8 +665,6 @@ foundit:
zend_hash_str_add_mem(&mydata->manifest, entry.filename, entry.filename_len, (void *)&entry, sizeof(phar_entry_info));
}
mydata->fp = fp;
if (zend_hash_str_exists(&(mydata->manifest), ".phar/stub.php", sizeof(".phar/stub.php")-1)) {
mydata->is_data = 0;
} else {
@@ -675,14 +673,11 @@ foundit:
/* ensure signature set */
if (!mydata->is_data && PHAR_G(require_hash) && !mydata->signature) {
php_stream_close(fp);
phar_destroy_phar_data(mydata);
if (error) {
spprintf(error, 0, "zip-based phar \"%s\" does not have a signature", fname);
}
return FAILURE;
PHAR_ZIP_FAIL("signature is missing");
}
mydata->fp = fp;
zend_hash_str_add_ptr(&(PHAR_G(phar_fname_map)), mydata->fname, fname_len, mydata);
if (actual_alias) {