mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-24 02:15:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.4' into PHP-8.0

Browse Source 
* PHP-7.4:
  Fix #81490: ZipArchive::extractTo() may leak memory
This commit is contained in:
Christoph M. Becker 2021-09-30 15:42:21 +02:00
commit 5db6e35843
No known key found for this signature in database
GPG Key ID: D66C9593118BCCB6
3 changed files with 27 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
NEWS
View File

@ -46,6 +46,9 @@ PHP NEWS
. Fixed bug #70962 (XML_OPTION_SKIP_WHITE strips embedded whitespace).
(Aliaksandr Bystry, cmb)
- Zip:
. Fixed bug #81490 (ZipArchive::extractTo() may leak memory). (cmb, Remi)
23 Sep 2021, PHP 8.0.11
- Core:

4
ext/zip/php_zip.c
View File

@ -149,11 +149,13 @@ static int php_zip_extract_file(struct zip * za, char *dest, char *file, size_t
virtual_file_ex(&new_state, file, NULL, CWD_EXPAND);
path_cleaned = php_zip_make_relative_path(new_state.cwd, new_state.cwd_length);
if(!path_cleaned) {
CWD_STATE_FREE(new_state.cwd);
return 0;
}
path_cleaned_len = strlen(path_cleaned);
if (path_cleaned_len >= MAXPATHLEN || zip_stat(za, file, 0, &sb) != 0) {
CWD_STATE_FREE(new_state.cwd);
return 0;
}
@ -188,8 +190,8 @@ static int php_zip_extract_file(struct zip * za, char *dest, char *file, size_t
efree(file_dirname_fullpath);
if (!is_dir_only) {
zend_string_release_ex(file_basename, 0);
CWD_STATE_FREE(new_state.cwd);
}
CWD_STATE_FREE(new_state.cwd);
return 0;
}
}

21
ext/zip/tests/bug81490.phpt Normal file
View File

@ -0,0 +1,21 @@
--TEST--
Bug #81490 (ZipArchive::extractTo() may leak memory)
--SKIPIF--
<?php
if (!extension_loaded("zip")) die("skip zip extension not available");
?>
--FILE--
<?php
$zip = new ZipArchive();
$zip->open(__DIR__ . "/bug81490.zip", ZipArchive::CREATE|ZipArchive::OVERWRITE);
$zip->addFromString("", "yada yada");
mkdir(__DIR__ . "/bug81490");
$zip->open(__DIR__ . "/bug81490.zip");
$zip->extractTo(__DIR__ . "/bug81490", "");
?>
--EXPECT--
--CLEAN--
<?php
@unlink(__DIR__ . "/bug81490.zip");
@rmdir(__DIR__ . "/bug81490");
?>