new test for truncated file comment, fix memleak found by test

diff --git a/ext/phar/tests/zip/corrupt_003.phpt b/ext/phar/tests/zip/corrupt_003.phpt
new file mode 100644 (file)
index 0000000..c41e015
--- /dev/null
+++ b/ext/phar/tests/zip/corrupt_003.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Phar: corrupted zip (truncated file comment)
+--SKIPIF--
+<?php if (!extension_loaded("phar")) die("skip"); ?>
+<?php if (!extension_loaded("spl")) die("skip SPL not available"); ?>
+--FILE--
+<?php
+try {
+       new PharData(dirname(__FILE__) . '/files/filecomment.zip');
+} catch (Exception $e) {
+       echo $e->getMessage() . "\n";
+}
+?>
+===DONE===
+--EXPECTF--
+phar error: corrupt zip archive, zip file comment truncated in zip-based phar "%sfilecomment.zip"
+===DONE===

diff --git a/ext/phar/tests/zip/files/corrupt_count1.php.inc b/ext/phar/tests/zip/files/corrupt_count1.php.inc
index 2a5e01a8fda592cb6bd1c52b4d10e2b9b4d7a104..17a3a62e4914660afe8e495da6233fe5071782e2 100644 (file)
--- a/ext/phar/tests/zip/files/corrupt_count1.php.inc
+++ b/ext/phar/tests/zip/files/corrupt_count1.php.inc
@@ -6,4 +6,5 @@ $a->addFile('hi2', null, 'hii2');
 $a->writeZip(dirname(__FILE__) . '/count1.zip', 'count1');
 $a->writeZip(dirname(__FILE__) . '/count2.zip', 'count2');
 $a->writeZip(dirname(__FILE__) . '/nozipend.zip', 'none');
+$a->writeZip(dirname(__FILE__) . '/filecomment.zip', 'comment');
 ?>

diff --git a/ext/phar/tests/zip/files/count1.zip b/ext/phar/tests/zip/files/count1.zip
index adfb4a9f1e373444a5991bc051ade88b55e43ad8..2a156cb3f51f6e11110eca3193577f3d39e43475 100644 (file)
Binary files a/ext/phar/tests/zip/files/count1.zip and b/ext/phar/tests/zip/files/count1.zip differ

diff --git a/ext/phar/tests/zip/files/count2.zip b/ext/phar/tests/zip/files/count2.zip
index 6976cb1a1f5b08219eff72ccb1572cf625fb8b25..0da6f9c7ba475676e8949ae8c2bc13925c844338 100644 (file)
Binary files a/ext/phar/tests/zip/files/count2.zip and b/ext/phar/tests/zip/files/count2.zip differ

diff --git a/ext/phar/tests/zip/files/filecomment.zip b/ext/phar/tests/zip/files/filecomment.zip
new file mode 100644 (file)
index 0000000..d1f9bfb
Binary files /dev/null and b/ext/phar/tests/zip/files/filecomment.zip differ

diff --git a/ext/phar/tests/zip/files/nozipend.zip b/ext/phar/tests/zip/files/nozipend.zip
index b64f597c38ec9bcb8a1c78ea3096a85490b7b13b..d91268c6159207b686c996d3aa133aee46ab2a38 100644 (file)
Binary files a/ext/phar/tests/zip/files/nozipend.zip and b/ext/phar/tests/zip/files/nozipend.zip differ

diff --git a/ext/phar/zip.c b/ext/phar/zip.c
index 4581676f9e09c2faad6795c8cadc13f3dd2f2bac..6724cf6825b745b675a1d2355bb2986e631bc4a1 100644 (file)
--- a/ext/phar/zip.c
+++ b/ext/phar/zip.c
@@ -212,9 +212,13 @@ foundit:
        if (locator.comment_len) {
                metadata = (char *) emalloc(PHAR_GET_16(locator.comment_len));
                if (locator.comment_len != php_stream_read(fp, metadata, PHAR_GET_16(locator.comment_len))) {
+                       if (error) {
+                               spprintf(error, 4096, "phar error: corrupt zip archive, zip file comment truncated in zip-based phar \"%s\"", fname);
+                       }
                        php_stream_close(fp);
                        efree(mydata->fname);
                        efree(mydata);
+                       efree(metadata);
                        return FAILURE;
                }
                if (phar_parse_metadata(&metadata, &mydata->metadata, PHAR_GET_16(locator.comment_len) TSRMLS_CC) == FAILURE) {