Additional fix for bug #69324

Not so happy about duplication but needed due to bug #69429

diff --git a/ext/phar/phar.c b/ext/phar/phar.c
index bf0c985a7c3a21741a48188728909b33eb8af983..c5c8b467bcda1519c98b257f3ba7c78f176cc115 100644 (file)
--- a/ext/phar/phar.c
+++ b/ext/phar/phar.c
@@ -600,27 +600,28 @@ int phar_open_parsed_phar(char *fname, int fname_len, char *alias, int alias_len
  *
  * Meta-data is in this format:
  * [len32][data...]
- * 
+ *
  * data is the serialized zval
  */
 int phar_parse_metadata(char **buffer, zval **metadata, php_uint32 zip_metadata_len TSRMLS_DC) /* {{{ */
 {
-       const unsigned char *p;
        php_unserialize_data_t var_hash;
 
        if (zip_metadata_len) {
+               const unsigned char *p, *p_buff = estrndup(*buffer, zip_metadata_len);
+               p = p_buff;
                ALLOC_ZVAL(*metadata);
                INIT_ZVAL(**metadata);
-               p = (const unsigned char*) *buffer;
                PHP_VAR_UNSERIALIZE_INIT(var_hash);
 
                if (!php_var_unserialize(metadata, &p, p + zip_metadata_len, &var_hash TSRMLS_CC)) {
+                       efree(p_buff);
                        PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
                        zval_ptr_dtor(metadata);
                        *metadata = NULL;
                        return FAILURE;
                }
-
+               efree(p_buff);
                PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
 
                if (PHAR_G(persist)) {
@@ -643,7 +644,7 @@ int phar_parse_metadata(char **buffer, zval **metadata, php_uint32 zip_metadata_
  *
  * Parse a new one and add it to the cache, returning either SUCCESS or
  * FAILURE, and setting pphar to the pointer to the manifest entry
- * 
+ *
  * This is used by phar_open_from_filename to process the manifest, but can be called
  * directly.
  */
@@ -2236,7 +2237,7 @@ last_time:
 
 /**
  * Process a phar stream name, ensuring we can handle any of:
- * 
+ *
  * - whatever.phar
  * - whatever.phar.gz
  * - whatever.phar.bz2