php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.3' into PHP-8.4

Browse Source 
* PHP-8.3:
  ext/zip: fix memory leak when encryption is passed as userland array option.
This commit is contained in:
David Carlier
2025-11-02 21:16:55 +00:00
parent 981b8c65ed 55f7303d73
commit 6d12688c9e
2 changed files with 56 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ext/zip/php_zip.c
View File

@@ -1838,6 +1838,11 @@ static void php_zip_add_from_pattern(INTERNAL_FUNCTION_PARAMETERS, int type) /*
}
#ifdef HAVE_ENCRYPTION
if (opts.enc_method >= 0) {
if (UNEXPECTED(zip_file_set_encryption(ze_obj->za, ze_obj->last_id, ZIP_EM_NONE, NULL) < 0)) {
zend_array_destroy(Z_ARR_P(return_value));
php_error_docref(NULL, E_WARNING, "password reset failed");
RETURN_FALSE;
}
if (zip_file_set_encryption(ze_obj->za, ze_obj->last_id, opts.enc_method, opts.enc_password)) {
zend_array_destroy(Z_ARR_P(return_value));
RETURN_FALSE;

51
ext/zip/tests/oo_addglob_leak.phpt Normal file
View File

@@ -0,0 +1,51 @@
--TEST--
ZipArchive::addGlob() method leaking after several calls when encryption is set.
--EXTENSIONS--
zip
--SKIPIF--
<?php
if (!method_exists('ZipArchive', 'setEncryptionName')) die('skip encrytion not supported');
if(!defined("GLOB_BRACE")) die ('skip requires GLOB_BRACE');
?>
--FILE--
<?php
$dirname = __DIR__ . '/';
include $dirname . 'utils.inc';
$dirname = __DIR__ . '/__tmp_oo_addglob2/';
$file = $dirname . 'test.zip';
@mkdir($dirname);
copy(__FILE__, $dirname . 'foo.txt');
copy(__FILE__, $dirname . 'bar.txt');
$zip = new ZipArchive();
if (!$zip->open($file, ZipArchive::CREATE | ZipArchive::OVERWRITE)) {
exit('failed');
}
$options = [
'remove_all_path' => true,
'comp_method' => ZipArchive::CM_STORE,
'comp_flags' => 5,
'enc_method' => ZipArchive::EM_AES_256,
'enc_password' => 'secret',
];
var_dump($zip->addGlob($dirname . 'bar.*', GLOB_BRACE, $options));
var_dump($zip->addGlob($dirname . 'bar.*', GLOB_BRACE, $options));
?>
--CLEAN--
<?php
$dirname = __DIR__ . '/';
include $dirname . 'utils.inc';
rmdir_rf(__DIR__ . '/__tmp_oo_addglob2/');
?>
--EXPECTF--
array(1) {
[0]=>
string(%d) "%s"
}
array(1) {
[0]=>
string(%d) "%s"
}