php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.3' into PHP-8.4

Browse Source 
* PHP-8.3:
  zip: Don't truncate return value of zip_fread() with user sizes
This commit is contained in:
Niels Dossche
2025-11-18 20:31:15 +01:00
parent 4401b03aa9 2f05830a5f
commit 4eacb6de83
2 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@@ -56,6 +56,7 @@ PHP NEWS
- Zip:
. Fix crash in property existence test. (ndossche)
. Don't truncate return value of zip_fread() with user sizes. (ndossche)
- Zlib:
. Fix assertion failures resulting in crashes with stream filter

7
ext/zip/php_zip.c
View File

@@ -1338,7 +1338,6 @@ PHP_FUNCTION(zip_entry_read)
zend_long len = 0;
zip_read_rsrc * zr_rsrc;
zend_string *buffer;
int n = 0;
if (zend_parse_parameters(ZEND_NUM_ARGS(), "r|l", &zip_entry, &len) == FAILURE) {
RETURN_THROWS();
@@ -1354,7 +1353,7 @@ PHP_FUNCTION(zip_entry_read)
if (zr_rsrc->zf) {
buffer = zend_string_safe_alloc(1, len, 0, 0);
n = zip_fread(zr_rsrc->zf, ZSTR_VAL(buffer), ZSTR_LEN(buffer));
zip_int64_t n = zip_fread(zr_rsrc->zf, ZSTR_VAL(buffer), ZSTR_LEN(buffer));
if (n > 0) {
ZSTR_VAL(buffer)[n] = '\0';
ZSTR_LEN(buffer) = n;
@@ -2916,8 +2915,6 @@ static void php_zip_get_from(INTERNAL_FUNCTION_PARAMETERS, int type) /* {{{ */
zend_string *filename;
zend_string *buffer;
int n = 0;
if (type == 1) {
if (zend_parse_parameters(ZEND_NUM_ARGS(), "P|ll", &filename, &len, &flags) == FAILURE) {
RETURN_THROWS();
@@ -2954,7 +2951,7 @@ static void php_zip_get_from(INTERNAL_FUNCTION_PARAMETERS, int type) /* {{{ */
}
buffer = zend_string_safe_alloc(1, len, 0, 0);
n = zip_fread(zf, ZSTR_VAL(buffer), ZSTR_LEN(buffer));
zip_int64_t n = zip_fread(zf, ZSTR_VAL(buffer), ZSTR_LEN(buffer));
if (n < 1) {
zend_string_efree(buffer);
RETURN_EMPTY_STRING();