From 10f6d9a556e6d2adeccdb7007edd7fc621c80131 Mon Sep 17 00:00:00 2001
From: Greg Beaver <cellog@php.net>
Date: Mon, 23 Jun 2008 04:00:23 +0000
Subject: [PATCH] true fix for potential segfault in phar_build

---
 ext/phar/phar.phar                           | Bin 15252 -> 15239 bytes
 ext/phar/phar_object.c                       |  23 +++++++++++--------
 ext/phar/tests/phar_buildfromdirectory4.phpt |   1 +
 3 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/ext/phar/phar.phar b/ext/phar/phar.phar
index 1eff3fd5ef7c156b4a1bdc6ae48b31d508af03e7..8d0ec2fea5d5b269427c9548cbcbd1aec251d3e2 100755
GIT binary patch
delta 220
zcmbPI-d@h5tf*gFT%@0qpPZPpQBsk0@+?+G<{0_-$@^H1%z(7VRR#tIPv>jS+XR6O
zAm9Vy<ebdp{M_8cycE66yyP?;1_qGI-CPU|LH4{klmD>F^MC|qsW32X-oE_U<QP^h
z3y?r5BLl;ib46`1vp9fe6=Wn9flLu&hM1xWRP!dA%?74sbF+{U^X6c--CUcuiq2Bm
s%qLjJxH-T|gHcBG_VWt{rVe3O|1UPsyS-)i*-fmMnSds`JNY^R02Pivxc~qF

delta 229
zcmZoKpHeQVtf-%npPQ<moSKu9pRQk$T3nJ?keHm2x{*hbRf&&*fgw33GdVvuH!&|o
zFEcMWO^1Qu^@3QB-CPU|LH4{klb^6^34jDj85tP9oGWVECdj}rS(8<j87Me8kkyC>
zBzYBRj;HfA=gB)+<;_6?vs4%uHg8{k45S(aIDohyBe4i%g%~r$3QeGiZ?f5JplUXk
zbME2VeAc3jakD#{A@gQqky$F6ovbt&WwtiV(_@X8l(nfOvXg(4ip_@$!W>LM1Kpi`
FodC-aNcjK&

diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
index 0078ab6959..ffd42bdb5d 100755
--- a/ext/phar/phar_object.c
+++ b/ext/phar/phar_object.c
@@ -1614,7 +1614,16 @@ after_open_fp:
 		if (error) {
 			efree(error);
 		}
-		contents_len = php_stream_copy_to_stream(fp, data->fp, PHP_STREAM_COPY_ALL);
+		/* convert to PHAR_UFP */
+		if (data->internal_file->fp_type == PHAR_MOD) {
+			php_stream_close(data->internal_file->fp);
+		}
+		data->internal_file->fp = NULL;
+		data->internal_file->fp_type = PHAR_UFP;
+		data->internal_file->offset_abs = data->internal_file->offset = php_stream_tell(p_obj->fp);
+		contents_len = php_stream_copy_to_stream(fp, p_obj->fp, PHP_STREAM_COPY_ALL);
+		data->internal_file->uncompressed_filesize = data->internal_file->compressed_filesize =
+			php_stream_tell(p_obj->fp) - data->internal_file->offset;
 	}
 	if (close_fp) {
 		php_stream_close(fp);
@@ -1632,15 +1641,6 @@ after_open_fp:
 	data->internal_file->compressed_filesize = data->internal_file->uncompressed_filesize = contents_len;
 	phar_entry_delref(data TSRMLS_CC);
 
-	if (++p_obj->count && p_obj->count % 900) {
-		/* every 900 files, flush so we remove open temp file handles, fixes Bug #45218 */
-		phar_flush(p_obj->p->arc.archive, 0, 0, 0, &error TSRMLS_CC);
-		if (error) {
-			zend_throw_exception_ex(phar_ce_PharException, 0 TSRMLS_CC, error);
-			efree(error);
-			return ZEND_HASH_APPLY_STOP;
-		}
-	}
 	return ZEND_HASH_APPLY_KEEP;
 }
 /* }}} */
@@ -1694,6 +1694,7 @@ PHP_METHOD(Phar, buildFromDirectory)
 
 	if (SUCCESS != object_init_ex(iteriter, spl_ce_RecursiveIteratorIterator)) {
 		zval_ptr_dtor(&iter);
+		zval_ptr_dtor(&iteriter);
 		zend_throw_exception_ex(spl_ce_BadMethodCallException, 0 TSRMLS_CC, "Unable to instantiate directory iterator for %s", phar_obj->arc.archive->fname);
 		RETURN_FALSE;
 	}
@@ -1714,6 +1715,7 @@ PHP_METHOD(Phar, buildFromDirectory)
 		MAKE_STD_ZVAL(regexiter);
 
 		if (SUCCESS != object_init_ex(regexiter, spl_ce_RegexIterator)) {
+			zval_ptr_dtor(&iteriter);
 			zval_dtor(regexiter);
 			zend_throw_exception_ex(spl_ce_BadMethodCallException, 0 TSRMLS_CC, "Unable to instantiate regex iterator for %s", phar_obj->arc.archive->fname);
 			RETURN_FALSE;
@@ -1748,6 +1750,7 @@ PHP_METHOD(Phar, buildFromDirectory)
 			efree(error);
 		}
 	} else {
+		zval_ptr_dtor(&iteriter);
 		php_stream_close(pass.fp);
 	}
 }
diff --git a/ext/phar/tests/phar_buildfromdirectory4.phpt b/ext/phar/tests/phar_buildfromdirectory4.phpt
index cf11d62af6..683ac4bbc8 100644
--- a/ext/phar/tests/phar_buildfromdirectory4.phpt
+++ b/ext/phar/tests/phar_buildfromdirectory4.phpt
@@ -5,6 +5,7 @@ Phar::buildFromDirectory(), directory exists
 --INI--
 phar.require_hash=0
 phar.readonly=0
+open_basedir=
 --FILE--
 <?php
 
-- 
2.50.1