From d144590d38fa321b46b8e199c754006318985c84 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Sun, 12 Jun 2016 16:43:12 -0700
Subject: [PATCH] Fix bug #72321 - use efree() for emalloc allocation

---
 ext/phar/phar_object.c       |   4 ++--
 ext/phar/tests/72321_1.zip   | Bin 0 -> 250 bytes
 ext/phar/tests/72321_2.zip   | Bin 0 -> 258 bytes
 ext/phar/tests/bug72321.phpt |  26 ++++++++++++++++++++++++++
 4 files changed, 28 insertions(+), 2 deletions(-)
 create mode 100644 ext/phar/tests/72321_1.zip
 create mode 100644 ext/phar/tests/72321_2.zip
 create mode 100644 ext/phar/tests/bug72321.phpt

diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
index 08d29831e0..64d7a6c76e 100644
--- a/ext/phar/phar_object.c
+++ b/ext/phar/phar_object.c
@@ -4217,14 +4217,14 @@ static int phar_extract_file(zend_bool overwrite, phar_entry_info *entry, char *
 			if (!php_stream_mkdir(fullpath, entry->flags & PHAR_ENT_PERM_MASK,  PHP_STREAM_MKDIR_RECURSIVE, NULL)) {
 				spprintf(error, 4096, "Cannot extract \"%s\", could not create directory \"%s\"", entry->filename, fullpath);
 				efree(fullpath);
-				free(new_state.cwd);
+				efree(new_state.cwd);
 				return FAILURE;
 			}
 		} else {
 			if (!php_stream_mkdir(fullpath, 0777,  PHP_STREAM_MKDIR_RECURSIVE, NULL)) {
 				spprintf(error, 4096, "Cannot extract \"%s\", could not create directory \"%s\"", entry->filename, fullpath);
 				efree(fullpath);
-				free(new_state.cwd);
+				efree(new_state.cwd);
 				return FAILURE;
 			}
 		}
diff --git a/ext/phar/tests/72321_1.zip b/ext/phar/tests/72321_1.zip
new file mode 100644
index 0000000000000000000000000000000000000000..ebc44ea282ce3fa00f88dc79b6cfbd0157d3f46f
GIT binary patch
literal 250
zcmWIWW@Zs#0D=D2Gag_Dl<)!4j!;km1WrKU3<V%QsUX0ckx7IZw_Py18yG<>>e|f8
Q1~QWo2&;f}7Kp<D0OeXoMF0Q*

literal 0
HcmV?d00001

diff --git a/ext/phar/tests/72321_2.zip b/ext/phar/tests/72321_2.zip
new file mode 100644
index 0000000000000000000000000000000000000000..de7ca266b8fd9c0ec09561c41aaf70d846795de4
GIT binary patch
literal 258
zcmWIWW@Zs#0D=D2Gag_Dln4OQj!;km1WrKU3<V%QsX#wTKRLjgkx7IZw|y}C8yG<>
U>f6rB1~Qis2<w1!9*DyL08;x&n*aa+

literal 0
HcmV?d00001

diff --git a/ext/phar/tests/bug72321.phpt b/ext/phar/tests/bug72321.phpt
new file mode 100644
index 0000000000..37aca19e82
--- /dev/null
+++ b/ext/phar/tests/bug72321.phpt
@@ -0,0 +1,26 @@
+--TEST--
+Phar: PHP bug #72321: invalid free in phar_extract_file()
+--SKIPIF--
+<?php if (!extension_loaded("phar")) die("skip"); ?>
+--FILE--
+<?php
+chdir(__DIR__);
+mkdir("test72321");
+$phar = new PharData("72321_1.zip");
+$phar->extractTo("test72321");
+$phar = new PharData("72321_2.zip");
+try {
+$phar->extractTo("test72321");
+} catch(PharException $e) {
+	print $e->getMessage()."\n";
+}
+?>
+DONE
+--CLEAN--
+<?php unlink(__DIR__."/test72321/AAAAAAAAxxxxBBBBCCCCCCCCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx");
+rmdir(__DIR__."/test72321");
+?>
+--EXPECTF--
+Warning: PharData::extractTo(): Not a directory in %s/bug72321.php on line %d
+Extraction from phar "%s/72321_2.zip" failed: Cannot extract "AAAAAAAAxxxxBBBBCCCCCCCCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/b/c", could not create directory "test72321/AAAAAAAAxxxxBBBBCCCCCCCCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/b"
+DONE
\ No newline at end of file
-- 
2.50.1