Skip to content

Commit f9785c2

Browse files
committed
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3: Add missing filter cleanups on phar failure
2 parents 445472c + 910aeaa commit f9785c2

File tree

3 files changed

+13
-0
lines changed

3 files changed

+13
-0
lines changed

NEWS

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
33
?? ??? ????, PHP 8.4.9
44

5+
- Phar:
6+
. Add missing filter cleanups on phar failure. (nielsdos)
7+
58
- SimpleXML:
69
. Fixed bug GH-18597 (Heap-buffer-overflow in zend_alloc.c when assigning
710
string with UTF-8 bytes). (nielsdos)

ext/phar/phar.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1706,6 +1706,7 @@ static zend_result phar_open_from_fp(php_stream* fp, char *fname, size_t fname_l
17061706
php_stream_filter_append(&temp->writefilters, filter);
17071707

17081708
if (SUCCESS != php_stream_copy_to_stream_ex(fp, temp, PHP_STREAM_COPY_ALL, NULL)) {
1709+
php_stream_filter_remove(filter, 1);
17091710
if (err) {
17101711
php_stream_close(temp);
17111712
MAPPHAR_ALLOC_FAIL("unable to decompress gzipped phar archive \"%s\", ext/zlib is buggy in PHP versions older than 5.2.6")
@@ -1752,6 +1753,7 @@ static zend_result phar_open_from_fp(php_stream* fp, char *fname, size_t fname_l
17521753
php_stream_filter_append(&temp->writefilters, filter);
17531754

17541755
if (SUCCESS != php_stream_copy_to_stream_ex(fp, temp, PHP_STREAM_COPY_ALL, NULL)) {
1756+
php_stream_filter_remove(filter, 1);
17551757
php_stream_close(temp);
17561758
MAPPHAR_ALLOC_FAIL("unable to decompress bzipped phar archive \"%s\" to temporary file")
17571759
}
@@ -2796,6 +2798,7 @@ void phar_flush_ex(phar_archive_data *phar, zend_string *user_stub, bool is_defa
27962798
}
27972799
entry->cfp = shared_cfp;
27982800
if (!entry->cfp) {
2801+
php_stream_filter_free(filter);
27992802
if (error) {
28002803
spprintf(error, 0, "unable to create temporary file");
28012804
}
@@ -2810,6 +2813,7 @@ void phar_flush_ex(phar_archive_data *phar, zend_string *user_stub, bool is_defa
28102813
entry->header_offset = php_stream_tell(entry->cfp);
28112814
php_stream_flush(file);
28122815
if (-1 == phar_seek_efp(entry, 0, SEEK_SET, 0, 0)) {
2816+
php_stream_filter_free(filter);
28132817
if (must_close_old_file) {
28142818
php_stream_close(oldfile);
28152819
}
@@ -2821,6 +2825,7 @@ void phar_flush_ex(phar_archive_data *phar, zend_string *user_stub, bool is_defa
28212825
}
28222826
php_stream_filter_append((&entry->cfp->writefilters), filter);
28232827
if (SUCCESS != php_stream_copy_to_stream_ex(file, entry->cfp, entry->uncompressed_filesize, NULL)) {
2828+
php_stream_filter_remove(filter, 1);
28242829
if (must_close_old_file) {
28252830
php_stream_close(oldfile);
28262831
}

ext/phar/zip.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -674,6 +674,7 @@ int phar_parse_zipfile(php_stream *fp, char *fname, size_t fname_len, char *alia
674674
}
675675

676676
if (!entry.uncompressed_filesize || !actual_alias) {
677+
php_stream_filter_remove(filter, 1);
677678
pefree(entry.filename, entry.is_persistent);
678679
PHAR_ZIP_FAIL("unable to read in alias, truncated");
679680
}
@@ -706,6 +707,7 @@ int phar_parse_zipfile(php_stream *fp, char *fname, size_t fname_len, char *alia
706707
}
707708

708709
if (!entry.uncompressed_filesize || !actual_alias) {
710+
php_stream_filter_remove(filter, 1);
709711
pefree(entry.filename, entry.is_persistent);
710712
PHAR_ZIP_FAIL("unable to read in alias, truncated");
711713
}
@@ -999,20 +1001,23 @@ static int phar_zip_changed_apply_int(phar_entry_info *entry, void *arg) /* {{{
9991001
entry->cfp = php_stream_fopen_tmpfile();
10001002

10011003
if (!entry->cfp) {
1004+
php_stream_filter_free(filter);
10021005
spprintf(p->error, 0, "unable to create temporary file for file \"%s\" while creating zip-based phar \"%s\"", entry->filename, entry->phar->fname);
10031006
return ZEND_HASH_APPLY_STOP;
10041007
}
10051008

10061009
php_stream_flush(efp);
10071010

10081011
if (-1 == phar_seek_efp(entry, 0, SEEK_SET, 0, 0)) {
1012+
php_stream_filter_free(filter);
10091013
spprintf(p->error, 0, "unable to seek to start of file \"%s\" to zip-based phar \"%s\"", entry->filename, entry->phar->fname);
10101014
return ZEND_HASH_APPLY_STOP;
10111015
}
10121016

10131017
php_stream_filter_append((&entry->cfp->writefilters), filter);
10141018

10151019
if (SUCCESS != php_stream_copy_to_stream_ex(efp, entry->cfp, entry->uncompressed_filesize, NULL)) {
1020+
php_stream_filter_remove(filter, 1);
10161021
spprintf(p->error, 0, "unable to copy compressed file contents of file \"%s\" while creating new phar \"%s\"", entry->filename, entry->phar->fname);
10171022
return ZEND_HASH_APPLY_STOP;
10181023
}

0 commit comments

Comments
 (0)