- Fixed bug #49072 (feof never returns true for damaged file in zip).

diff --git a/NEWS b/NEWS
index 3929ac5accf9257f9a39d22b51562b49e6c10d00..2e404ed62b48b53725aac8e83649aa39d9bd41ce 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -158,6 +158,8 @@
   . Fixed bug #53854 (Missing constants for compression type). (Richard, Adam)
   . Fixed bug #53885 (ZipArchive segfault with FL_UNCHANGED on empty archive).
     (Stas, Maksymilian Arciemowicz).
+  . Fixed bug #49072 (feof never returns true for damaged file in zip).
+    (Gustavo, Richard Quadling)
 
 - Fixed bug #51336 (snmprealwalk (snmp v1) does not handle end of OID tree correctly)
   (Boris Lytochkin)

diff --git a/ext/zip/zip_stream.c b/ext/zip/zip_stream.c
index dad09233e7b0453787d30f4a981f1afa5c2f2f6b..400edd6e6c0b9d46d66fc315429d1561cf9de34b 100644 (file)
--- a/ext/zip/zip_stream.c
+++ b/ext/zip/zip_stream.c
@@ -30,11 +30,11 @@ struct php_zip_stream_data_t {
 /* {{{ php_zip_ops_read */
 static size_t php_zip_ops_read(php_stream *stream, char *buf, size_t count TSRMLS_DC)
 {
-       size_t n = 0;
+       ssize_t n = 0;
        STREAM_DATA_FROM_STREAM();
 
        if (self->za && self->zf) {
-               n = (size_t)zip_fread(self->zf, buf, (int)count);
+               n = zip_fread(self->zf, buf, count);
                if (n < 0) {
                        int ze, se;
                        zip_file_error_get(self->zf, &ze, &se);
@@ -42,13 +42,15 @@ static size_t php_zip_ops_read(php_stream *stream, char *buf, size_t count TSRML
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Zip stream error: %s", zip_file_strerror(self->zf));
                        return 0;
                }
-               if (n == 0 || n < count) {
+               /* cast count to signed value to avoid possibly negative n
+                * being cast to unsigned value */
+               if (n == 0 || n < (ssize_t)count) {
                        stream->eof = 1;
                } else {
                        self->cursor += n;
                }
        }
-       return (n < 1 ? 0 : n);
+       return (n < 1 ? 0 : (size_t)n);
 }
 /* }}} */