Skip to content

Commit

Permalink
Fix phpGH-17139: Fix zip_entry_name() crash on invalid entry.
Browse files Browse the repository at this point in the history
Increasing the GC refcount when reading the zip entry before
zip_entry_name() fetches the info, leading to a dangling pointer
otherwise.
  • Loading branch information
devnexen committed Dec 13, 2024
1 parent e7af08d commit 24c2694
Show file tree
Hide file tree
Showing 2 changed files with 20 additions and 0 deletions.
1 change: 1 addition & 0 deletions ext/zip/php_zip.c
Original file line number Diff line number Diff line change
Expand Up @@ -1257,6 +1257,7 @@ PHP_FUNCTION(zip_read)

zr_rsrc->zf = zip_fopen_index(rsrc_int->za, rsrc_int->index_current, 0);
if (zr_rsrc->zf) {
Z_ADDREF_P(zip_dp);
rsrc_int->index_current++;
RETURN_RES(zend_register_resource(zr_rsrc, le_zip_entry));
} else {
Expand Down
19 changes: 19 additions & 0 deletions ext/zip/tests/gh17139.phpt
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
--TEST--
GH-17139 - zip_entry_name() crash
--EXTENSIONS--
zip
--FILE--
<?php
$zip = zip_open(__DIR__."/test_procedural.zip");
if (!is_resource($zip)) die("Failure");
// no need to bother looping over, the entry name should point to a dangling address from the first iteration
$zip = zip_read($zip);
var_dump(zip_entry_name($zip));
?>
--EXPECTF--
Deprecated: Function zip_open() is deprecated in %s on line %d

Deprecated: Function zip_read() is deprecated in %s on line %d

Deprecated: Function zip_entry_name() is deprecated in %s on line %d
string(3) "foo"

0 comments on commit 24c2694

Please sign in to comment.