Prevent double-free of Phar ZIP stream

We must not alias the closed stream to `phar_archive_data.fp`, and use
PHAR_ZIP_FAIL() for consistency with the rest of this function.

Closes GH-6578.

diff --git a/ext/phar/tests/zip/require_hash.phpt b/ext/phar/tests/zip/require_hash.phpt
index 23943550ae33b57ee6901c1555b83d8089238cbf..994cc0eb676a4372f59ecd5ebc6fd59a98117c9a 100644 (file)
--- a/ext/phar/tests/zip/require_hash.phpt
+++ b/ext/phar/tests/zip/require_hash.phpt
@@ -45,7 +45,7 @@ try {
 @unlink(__DIR__ . '/require_hash.zip');\r
 ?>\r
 --EXPECTF--\r
-zip-based phar "%srequire_hash.phar.zip" does not have a signature\r
+phar error: signature is missing in zip-based phar "%srequire_hash.phar.zip"\r
 bool(false)\r
 array(2) {\r
   ["hash"]=>\r

diff --git a/ext/phar/zip.c b/ext/phar/zip.c
index 1b94943ad302e0611f6d98567e91dc2beb2e5118..f3aef85cd9a43129d2274bed39b2a5d877091bd6 100644 (file)
--- a/ext/phar/zip.c
+++ b/ext/phar/zip.c
@@ -665,8 +665,6 @@ foundit:
                zend_hash_str_add_mem(&mydata->manifest, entry.filename, entry.filename_len, (void *)&entry, sizeof(phar_entry_info));
        }
 
-       mydata->fp = fp;
-
        if (zend_hash_str_exists(&(mydata->manifest), ".phar/stub.php", sizeof(".phar/stub.php")-1)) {
                mydata->is_data = 0;
        } else {
@@ -675,14 +673,11 @@ foundit:
 
        /* ensure signature set */
        if (!mydata->is_data && PHAR_G(require_hash) && !mydata->signature) {
-               php_stream_close(fp);
-               phar_destroy_phar_data(mydata);
-               if (error) {
-                       spprintf(error, 0, "zip-based phar \"%s\" does not have a signature", fname);
-               }
-               return FAILURE;
+               PHAR_ZIP_FAIL("signature is missing");
        }
 
+       mydata->fp = fp;
+
        zend_hash_str_add_ptr(&(PHAR_G(phar_fname_map)), mydata->fname, fname_len, mydata);
 
        if (actual_alias) {