Skip to content

Commit 24c2694

Browse files
committed
Fix phpGH-17139: Fix zip_entry_name() crash on invalid entry.
Increasing the GC refcount when reading the zip entry before zip_entry_name() fetches the info, leading to a dangling pointer otherwise.
1 parent e7af08d commit 24c2694

File tree

2 files changed

+20
-0
lines changed

2 files changed

+20
-0
lines changed

ext/zip/php_zip.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1257,6 +1257,7 @@ PHP_FUNCTION(zip_read)
12571257

12581258
zr_rsrc->zf = zip_fopen_index(rsrc_int->za, rsrc_int->index_current, 0);
12591259
if (zr_rsrc->zf) {
1260+
Z_ADDREF_P(zip_dp);
12601261
rsrc_int->index_current++;
12611262
RETURN_RES(zend_register_resource(zr_rsrc, le_zip_entry));
12621263
} else {

ext/zip/tests/gh17139.phpt

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
--TEST--
2+
GH-17139 - zip_entry_name() crash
3+
--EXTENSIONS--
4+
zip
5+
--FILE--
6+
<?php
7+
$zip = zip_open(__DIR__."/test_procedural.zip");
8+
if (!is_resource($zip)) die("Failure");
9+
// no need to bother looping over, the entry name should point to a dangling address from the first iteration
10+
$zip = zip_read($zip);
11+
var_dump(zip_entry_name($zip));
12+
?>
13+
--EXPECTF--
14+
Deprecated: Function zip_open() is deprecated in %s on line %d
15+
16+
Deprecated: Function zip_read() is deprecated in %s on line %d
17+
18+
Deprecated: Function zip_entry_name() is deprecated in %s on line %d
19+
string(3) "foo"

0 commit comments

Comments
 (0)