com php-src: Fixed bug #64452 Zip PHPTs crash intermittently: NEWS ext/zip/lib/zip_close.c ext/zip/lib/zip_dirent.c

Commit: bb935ff8dc65c52efea6aae6697a806dc86c8580 Author: Anatol Belski <ab@php.net> Wed, 20 Mar 2013 09:10:10 +0100 Parents: 8d199c7c4f93ebe5b9293096143d7007a6ad13a4 Branches: PHP-5.3 PHP-5.4 PHP-5.5 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=bb935ff8dc65c52efea6aae6697a806dc86c8580 Log: Fixed bug #64452 Zip PHPTs crash intermittently Bugs: https://bugs.php.net/64452 Changed paths: M NEWS M ext/zip/lib/zip_close.c M ext/zip/lib/zip_dirent.c Diff: diff --git a/NEWS b/NEWS index facb9ad..d62e1a1 100644 --- a/NEWS +++ b/NEWS @@ -17,6 +17,9 @@ PHP NEWS - DateTime . Fixed bug #62852 (Unserialize Invalid Date causes crash). (Anatol) +- Zip: + . Bug #64452 (Zip crash intermittently). (Anatol) + 14 Mar 2013, PHP 5.3.23 diff --git a/ext/zip/lib/zip_close.c b/ext/zip/lib/zip_close.c index 362f92d..e66c566 100644 --- a/ext/zip/lib/zip_close.c +++ b/ext/zip/lib/zip_close.c @@ -88,6 +88,9 @@ zip_close(struct zip *za) if (za == NULL) return -1; + if (za->zp == NULL) + return -1; + if (!_zip_changed(za, &survivors)) { _zip_free(za); return 0; @@ -164,9 +167,10 @@ zip_close(struct zip *za) for (j=0; j<survivors; j++) { i = filelist[j].idx; + _zip_dirent_init(&de); + /* create new local directory entry */ if (ZIP_ENTRY_DATA_CHANGED(za->entry+i) || new_torrentzip) { - _zip_dirent_init(&de); if (zip_get_archive_flag(za, ZIP_AFL_TORRENT, 0)) _zip_dirent_torrent_normalize(&de); diff --git a/ext/zip/lib/zip_dirent.c b/ext/zip/lib/zip_dirent.c index b5b9d27..b9dac5c 100644 --- a/ext/zip/lib/zip_dirent.c +++ b/ext/zip/lib/zip_dirent.c @@ -157,11 +157,17 @@ _zip_cdir_write(struct zip_cdir *cd, FILE *fp, struct zip_error *error) void _zip_dirent_finalize(struct zip_dirent *zde) { - free(zde->filename); + if (zde->filename_len > 0) { + free(zde->filename); + } zde->filename = NULL; - free(zde->extrafield); + if (zde->extrafield_len > 0) { + free(zde->extrafield); + } zde->extrafield = NULL; - free(zde->comment); + if (zde->comment_len > 0) { + free(zde->comment); + } zde->comment = NULL; }