From: Greg Beaver <cellog@php.net>
Date: Sat, 19 Apr 2008 05:39:42 +0000 (+0000)
Subject: new test for truncated file comment, fix memleak found by test
X-Git-Tag: RELEASE_2_0_0b1~326
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bd3ddde29f402b8d5ecbbbb5c53e8e7501bddc42;p=php

new test for truncated file comment, fix memleak found by test
---

diff --git a/ext/phar/tests/zip/corrupt_003.phpt b/ext/phar/tests/zip/corrupt_003.phpt
new file mode 100644
index 0000000000..c41e0153d8
--- /dev/null
+++ b/ext/phar/tests/zip/corrupt_003.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Phar: corrupted zip (truncated file comment)
+--SKIPIF--
+<?php if (!extension_loaded("phar")) die("skip"); ?>
+<?php if (!extension_loaded("spl")) die("skip SPL not available"); ?>
+--FILE--
+<?php
+try {
+	new PharData(dirname(__FILE__) . '/files/filecomment.zip');
+} catch (Exception $e) {
+	echo $e->getMessage() . "\n";
+}
+?>
+===DONE===
+--EXPECTF--
+phar error: corrupt zip archive, zip file comment truncated in zip-based phar "%sfilecomment.zip"
+===DONE===
diff --git a/ext/phar/tests/zip/files/corrupt_count1.php.inc b/ext/phar/tests/zip/files/corrupt_count1.php.inc
index 2a5e01a8fd..17a3a62e49 100644
--- a/ext/phar/tests/zip/files/corrupt_count1.php.inc
+++ b/ext/phar/tests/zip/files/corrupt_count1.php.inc
@@ -6,4 +6,5 @@ $a->addFile('hi2', null, 'hii2');
 $a->writeZip(dirname(__FILE__) . '/count1.zip', 'count1');
 $a->writeZip(dirname(__FILE__) . '/count2.zip', 'count2');
 $a->writeZip(dirname(__FILE__) . '/nozipend.zip', 'none');
+$a->writeZip(dirname(__FILE__) . '/filecomment.zip', 'comment');
 ?>
diff --git a/ext/phar/tests/zip/files/count1.zip b/ext/phar/tests/zip/files/count1.zip
index adfb4a9f1e..2a156cb3f5 100644
Binary files a/ext/phar/tests/zip/files/count1.zip and b/ext/phar/tests/zip/files/count1.zip differ
diff --git a/ext/phar/tests/zip/files/count2.zip b/ext/phar/tests/zip/files/count2.zip
index 6976cb1a1f..0da6f9c7ba 100644
Binary files a/ext/phar/tests/zip/files/count2.zip and b/ext/phar/tests/zip/files/count2.zip differ
diff --git a/ext/phar/tests/zip/files/filecomment.zip b/ext/phar/tests/zip/files/filecomment.zip
new file mode 100644
index 0000000000..d1f9bfb1ef
Binary files /dev/null and b/ext/phar/tests/zip/files/filecomment.zip differ
diff --git a/ext/phar/tests/zip/files/nozipend.zip b/ext/phar/tests/zip/files/nozipend.zip
index b64f597c38..d91268c615 100644
Binary files a/ext/phar/tests/zip/files/nozipend.zip and b/ext/phar/tests/zip/files/nozipend.zip differ
diff --git a/ext/phar/zip.c b/ext/phar/zip.c
index 4581676f9e..6724cf6825 100644
--- a/ext/phar/zip.c
+++ b/ext/phar/zip.c
@@ -212,9 +212,13 @@ foundit:
 	if (locator.comment_len) {
 		metadata = (char *) emalloc(PHAR_GET_16(locator.comment_len));
 		if (locator.comment_len != php_stream_read(fp, metadata, PHAR_GET_16(locator.comment_len))) {
+			if (error) {
+				spprintf(error, 4096, "phar error: corrupt zip archive, zip file comment truncated in zip-based phar \"%s\"", fname);
+			}
 			php_stream_close(fp);
 			efree(mydata->fname);
 			efree(mydata);
+			efree(metadata);
 			return FAILURE;
 		}
 		if (phar_parse_metadata(&metadata, &mydata->metadata, PHAR_GET_16(locator.comment_len) TSRMLS_CC) == FAILURE) {