From bd3ddde29f402b8d5ecbbbb5c53e8e7501bddc42 Mon Sep 17 00:00:00 2001
From: Greg Beaver <cellog@php.net>
Date: Sat, 19 Apr 2008 05:39:42 +0000
Subject: [PATCH] new test for truncated file comment, fix memleak found by
 test

---
 ext/phar/tests/zip/corrupt_003.phpt            |  17 +++++++++++++++++
 .../tests/zip/files/corrupt_count1.php.inc     |   1 +
 ext/phar/tests/zip/files/count1.zip            | Bin 191 -> 191 bytes
 ext/phar/tests/zip/files/count2.zip            | Bin 191 -> 191 bytes
 ext/phar/tests/zip/files/filecomment.zip       | Bin 0 -> 191 bytes
 ext/phar/tests/zip/files/nozipend.zip          | Bin 169 -> 169 bytes
 ext/phar/zip.c                                 |   4 ++++
 7 files changed, 22 insertions(+)
 create mode 100644 ext/phar/tests/zip/corrupt_003.phpt
 create mode 100644 ext/phar/tests/zip/files/filecomment.zip

diff --git a/ext/phar/tests/zip/corrupt_003.phpt b/ext/phar/tests/zip/corrupt_003.phpt
new file mode 100644
index 0000000000..c41e0153d8
--- /dev/null
+++ b/ext/phar/tests/zip/corrupt_003.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Phar: corrupted zip (truncated file comment)
+--SKIPIF--
+<?php if (!extension_loaded("phar")) die("skip"); ?>
+<?php if (!extension_loaded("spl")) die("skip SPL not available"); ?>
+--FILE--
+<?php
+try {
+	new PharData(dirname(__FILE__) . '/files/filecomment.zip');
+} catch (Exception $e) {
+	echo $e->getMessage() . "\n";
+}
+?>
+===DONE===
+--EXPECTF--
+phar error: corrupt zip archive, zip file comment truncated in zip-based phar "%sfilecomment.zip"
+===DONE===
diff --git a/ext/phar/tests/zip/files/corrupt_count1.php.inc b/ext/phar/tests/zip/files/corrupt_count1.php.inc
index 2a5e01a8fd..17a3a62e49 100644
--- a/ext/phar/tests/zip/files/corrupt_count1.php.inc
+++ b/ext/phar/tests/zip/files/corrupt_count1.php.inc
@@ -6,4 +6,5 @@ $a->addFile('hi2', null, 'hii2');
 $a->writeZip(dirname(__FILE__) . '/count1.zip', 'count1');
 $a->writeZip(dirname(__FILE__) . '/count2.zip', 'count2');
 $a->writeZip(dirname(__FILE__) . '/nozipend.zip', 'none');
+$a->writeZip(dirname(__FILE__) . '/filecomment.zip', 'comment');
 ?>
diff --git a/ext/phar/tests/zip/files/count1.zip b/ext/phar/tests/zip/files/count1.zip
index adfb4a9f1e373444a5991bc051ade88b55e43ad8..2a156cb3f51f6e11110eca3193577f3d39e43475 100644
GIT binary patch
delta 34
kcmdnbxSx?bz?+#xgaHIDP2^T$yfjfy4M>FQ1Bq5E0FTuPl>h($

delta 34
kcmdnbxSx?bz?+#xgaHJcCUPq=I!)A50}`S7K%&(O0Cn{TRR910

diff --git a/ext/phar/tests/zip/files/count2.zip b/ext/phar/tests/zip/files/count2.zip
index 6976cb1a1f5b08219eff72ccb1572cf625fb8b25..0da6f9c7ba475676e8949ae8c2bc13925c844338 100644
GIT binary patch
delta 34
kcmdnbxSx?bz?+#xgaHIDP2^T$yfjfy4M>FQ1Bq5E0FTuPl>h($

delta 34
kcmdnbxSx?bz?+#xgaHJcCUPq=I!)A50}`S7K%&(O0Cn{TRR910

diff --git a/ext/phar/tests/zip/files/filecomment.zip b/ext/phar/tests/zip/files/filecomment.zip
new file mode 100644
index 0000000000000000000000000000000000000000..d1f9bfb1efb29aa79441e26eff3c603ef8e71e3c
GIT binary patch
literal 191
zcmWIWW@Zs#0D(&^lPzX=U9n^avO$;$h%+)XGBX2Elo%FTJYfM!fiOr}My3%^jZuI%
rBTxfwlYlCbKnBoIRQ2e_A`}|{nLtYdyjj^mf=oc@0i=_Fn2`Yh>Nyyw

literal 0
HcmV?d00001

diff --git a/ext/phar/tests/zip/files/nozipend.zip b/ext/phar/tests/zip/files/nozipend.zip
index b64f597c38ec9bcb8a1c78ea3096a85490b7b13b..d91268c6159207b686c996d3aa133aee46ab2a38 100644
GIT binary patch
delta 34
kcmZ3<xRQ}Oz?+#xgaHIDP2^T$yfjfy4M>FQ1Bq4@0E!a{Qvd(}

delta 34
kcmZ3<xRQ}Oz?+#xgaHJcCUPq=I!)A50}`S7K%!Lz0B|!06951J

diff --git a/ext/phar/zip.c b/ext/phar/zip.c
index 4581676f9e..6724cf6825 100644
--- a/ext/phar/zip.c
+++ b/ext/phar/zip.c
@@ -212,9 +212,13 @@ foundit:
 	if (locator.comment_len) {
 		metadata = (char *) emalloc(PHAR_GET_16(locator.comment_len));
 		if (locator.comment_len != php_stream_read(fp, metadata, PHAR_GET_16(locator.comment_len))) {
+			if (error) {
+				spprintf(error, 4096, "phar error: corrupt zip archive, zip file comment truncated in zip-based phar \"%s\"", fname);
+			}
 			php_stream_close(fp);
 			efree(mydata->fname);
 			efree(mydata);
+			efree(metadata);
 			return FAILURE;
 		}
 		if (phar_parse_metadata(&metadata, &mydata->metadata, PHAR_GET_16(locator.comment_len) TSRMLS_CC) == FAILURE) {
-- 
2.50.1