Skip to content

Commit 3977650

Browse files
committed
Merge branch 'PHP-8.5'
* PHP-8.5: Fix crash in property existence test in ext/zip
2 parents bc08fa3 + 75cd8fb commit 3977650

File tree

2 files changed

+24
-5
lines changed

2 files changed

+24
-5
lines changed

ext/zip/php_zip.c

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -928,17 +928,16 @@ static int php_zip_has_property(zend_object *object, zend_string *name, int type
928928
if (hnd != NULL) {
929929
zval tmp, *prop;
930930

931-
if (type == 2) {
931+
if (type == ZEND_PROPERTY_EXISTS) {
932932
retval = true;
933933
} else if ((prop = php_zip_property_reader(obj, hnd, &tmp)) != NULL) {
934-
if (type == 1) {
934+
if (type == ZEND_PROPERTY_NOT_EMPTY) {
935935
retval = zend_is_true(&tmp);
936-
} else if (type == 0) {
936+
} else if (type == ZEND_PROPERTY_ISSET) {
937937
retval = (Z_TYPE(tmp) != IS_NULL);
938938
}
939+
zval_ptr_dtor(&tmp);
939940
}
940-
941-
zval_ptr_dtor(&tmp);
942941
} else {
943942
retval = zend_std_has_property(object, name, type, cache_slot);
944943
}
Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
--TEST--
2+
Property existence test can cause a crash
3+
--EXTENSIONS--
4+
zip
5+
--FILE--
6+
<?php
7+
8+
$archive = new ZipArchive(__DIR__.'/property_existence.zip');
9+
var_dump(array_column([$archive], 'lastId'));
10+
11+
?>
12+
--CLEAN--
13+
<?php
14+
@unlink(__DIR__.'/property_existence.zip');
15+
?>
16+
--EXPECT--
17+
array(1) {
18+
[0]=>
19+
int(-1)
20+
}

0 commit comments

Comments
 (0)