php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix reference handling in cancel callback (#18439)

Browse Source 
Broke in 8765e9f5e7
This commit is contained in:
Niels Dossche
2025-04-27 11:27:18 +02:00
committed by GitHub
parent c919ab4bdf
commit 1ec9041bf8
2 changed files with 31 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ext/zip/php_zip.c
View File

@@ -3073,10 +3073,12 @@ static int php_zip_cancel_callback(zip_t *arch, void *ptr)
return -1;
}
bool failed = false;
zend_long retval = zval_try_get_long(&cb_retval, &failed);
zval *cb_retval_ptr = &cb_retval;
ZVAL_DEREF(cb_retval_ptr);
zend_long retval = zval_try_get_long(cb_retval_ptr, &failed);
if (failed) {
zend_type_error("Return value of callback provided to ZipArchive::registerCancelCallback()"
" must be of type int, %s returned", zend_zval_value_name(&cb_retval));
" must be of type int, %s returned", zend_zval_value_name(cb_retval_ptr));
zval_ptr_dtor(&cb_retval);
return -1;
}

27
ext/zip/tests/gh18439.phpt Normal file
View File

@@ -0,0 +1,27 @@
--TEST--
GH-18439 (Reference handling in cancel callback)
--EXTENSIONS--
zip
--FILE--
<?php
function &cb() {
$test = false;
return $test;
}
$file = __DIR__ . '/gh18439.zip';
$zip = new ZipArchive;
$zip->open($file, ZIPARCHIVE::CREATE);
$zip->registerCancelCallback(cb(...));
$zip->addFromString('test', 'test');
echo "Done\n";
?>
--CLEAN--
<?php
$file = __DIR__ . '/gh18439.zip';
@unlink($file);
?>
--EXPECT--
Done