Skip to content

Commit 2d545dd

Browse files
committed
Merge branch 'PHP-8.4'
* PHP-8.4: Fix phpGH-19688: Remove pattern overflow in zip addGlob()
2 parents c15d51f + 98aba6c commit 2d545dd

File tree

2 files changed

+22
-1
lines changed

2 files changed

+22
-1
lines changed

ext/zip/php_zip.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1742,7 +1742,7 @@ static void php_zip_add_from_pattern(INTERNAL_FUNCTION_PARAMETERS, int type) /*
17421742
basename = php_basename(Z_STRVAL_P(zval_file), Z_STRLEN_P(zval_file), NULL, 0);
17431743
file_stripped = ZSTR_VAL(basename);
17441744
file_stripped_len = ZSTR_LEN(basename);
1745-
} else if (opts.remove_path && !memcmp(Z_STRVAL_P(zval_file), opts.remove_path, opts.remove_path_len)) {
1745+
} else if (opts.remove_path && Z_STRLEN_P(zval_file) > opts.remove_path_len && !memcmp(Z_STRVAL_P(zval_file), opts.remove_path, opts.remove_path_len)) {
17461746
if (IS_SLASH(Z_STRVAL_P(zval_file)[opts.remove_path_len])) {
17471747
file_stripped = Z_STRVAL_P(zval_file) + opts.remove_path_len + 1;
17481748
file_stripped_len = Z_STRLEN_P(zval_file) - opts.remove_path_len - 1;

ext/zip/tests/gh19688.phpt

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
--TEST--
2+
GH-19688 (Remove pattern overflow in zip addGlob())
3+
--EXTENSIONS--
4+
zip
5+
--FILE--
6+
<?php
7+
$dir = __DIR__ . '/';
8+
$testfile = $dir . '001.phpt';
9+
$zip = new ZipArchive();
10+
$filename = $dir . '/gh19688.zip';
11+
$zip->open($filename, ZipArchive::CREATE | ZipArchive::OVERWRITE);
12+
$options = array('remove_path' => $dir . 'a very long string here that will overrun');
13+
$zip->addGlob($testfile, 0, $options);
14+
var_dump($zip->getNameIndex(0));
15+
?>
16+
--CLEAN--
17+
<?php
18+
@unlink(__DIR__ . '/gh19688.zip');
19+
?>
20+
--EXPECTF--
21+
string(%d) "%s001.phpt"

0 commit comments

Comments
 (0)