From: Ilia Alshanetsky <iliaa@php.net>
Date: Sun, 22 Feb 2009 17:54:50 +0000 (+0000)
Subject: Fixed 2 memory corruptions in zip extension idenfied by oo_properties.phpt
X-Git-Tag: RELEASE_1_3_5~73
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=551a2d52e2eda3c0e2ccea3c1b282c7338c50d33;p=php

Fixed 2 memory corruptions in zip extension idenfied by oo_properties.phpt
test
---

diff --git a/ext/zip/php_zip.c b/ext/zip/php_zip.c
index 006d543f4e..29f7ac69a8 100644
--- a/ext/zip/php_zip.c
+++ b/ext/zip/php_zip.c
@@ -792,7 +792,7 @@ static int php_zip_property_reader(ze_zip_object *obj, zip_prop_handler *hnd, zv
 	switch (hnd->type) {
 		case IS_STRING:
 			if (retchar) {
-				ZVAL_STRING(*retval, (char *) retchar, 1);
+				ZVAL_STRINGL(*retval, (char *) retchar, len, 1);
 			} else {
 				ZVAL_EMPTY_STRING(*retval);
 			}
@@ -915,10 +915,11 @@ static int php_zip_has_property(zval *object, zval *member, int type TSRMLS_DC)
 
 	if (ret == SUCCESS) {
 		zval *tmp;
+		ALLOC_INIT_ZVAL(tmp);
 
 		if (type == 2) {
 			retval = 1;
-		} else if (php_zip_property_reader(obj, hnd, &tmp, 1 TSRMLS_CC) == SUCCESS) {
+		} else if (php_zip_property_reader(obj, hnd, &tmp, 0 TSRMLS_CC) == SUCCESS) {
 			Z_SET_REFCOUNT_P(tmp, 1);
 			Z_UNSET_ISREF_P(tmp);
 			if (type == 1) {
@@ -926,8 +927,9 @@ static int php_zip_has_property(zval *object, zval *member, int type TSRMLS_DC)
 			} else if (type == 0) {
 				retval = (Z_TYPE_P(tmp) != IS_NULL);
 			}
-			zval_ptr_dtor(&tmp);
 		}
+
+		zval_ptr_dtor(&tmp);
 	} else {
 		std_hnd = zend_get_std_object_handlers();
 		retval = std_hnd->has_property(object, member, type TSRMLS_CC);