Bug #16340: ZZIP extension mem fault

From: Date: Fri, 29 Mar 2002 07:08:31 +0000
Subject: Bug #16340: ZZIP extension mem fault
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-3591@lists.php.net to get a copy of this message
From: programmer@mail2k.ru Operating system: Linux PHP version: 4.1.2 PHP Bug Type: Unknown/Other Function Bug description: ZZIP extension mem fault Let's look at ext/zip/zip.c Find any function that accepts resource handle and you'll see: -------------------------------------------- zval **zzip_dp; ZZIP_DIR *archive_p = NULL; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r", &zzip_dp) == FAILURE) { return; } ZEND_FETCH_RESOURCE(archive_p, ZZIP_DIR *, zzip_dp, -1, le_zip_dir_name, le_zip_dir); ---------------------------------------------- ZEND_FETCH_RESOURCE tries to fetch something from undefined pointer - zzip_dp. That is where core is being dumped. I've corrected the above problem this way: -------------------------------------------- zval *zzip_dp; ZZIP_DIR *archive_p = NULL; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r", &zzip_dp) == FAILURE) { return; } ZEND_FETCH_RESOURCE(archive_p, ZZIP_DIR *, &zzip_dp, -1, le_zip_dir_name, le_zip_dir); --------------------------------------------- Now it fetches resources from the correct place. You can download the whole corrected file from: http://programmer.mail2k.ru/zip.c WBR, Mail2K.RU programmer Andrew A. Kononykhin programmer@mail2k.ru -- Edit bug report at http://bugs.php.net/?id=16340&edit=1 -- Fixed in CVS: http://bugs.php.net/fix.php?id=16340&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=16340&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=16340&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=16340&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=16340&r=support Expected behavior: http://bugs.php.net/fix.php?id=16340&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=16340&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=16340&r=submittedtwice

« previous php.bugs (#3591) next »