[php-src] PR #23779: ext/zip: fix use-after-free in the archive destructor path

From: Date: Sat, 19 Sep 2026 21:04:06 +0000
Subject: [php-src] PR #23779: ext/zip: fix use-after-free in the archive destructor path
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-38600@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/23779 Author: jvoisin Commit 132403de396 guarded php_zipobj_close() and ZipArchive::open() with the archive->close flag so that a progress or cancel callback firing during zip_close() cannot re-enter and run a nested zip_close() followed by zip_discard(), which frees the archive still in use. php_zip_archive_release() was left unguarded. php_zipobj_close() sets archive->za = NULL before calling release(), so the close() path is safe, but when a ZipArchive is destroyed without an explicit close() the archive is finalized here with za still set. The progress/cancel callback fires during that zip_close(), and a re-entrant close() or open() then nests zip_close() on the same archive, causing the same use-after-free. Set archive->close around the release-path zip_close() as well, so the re-entrant call throws "Already being closed" instead of nesting.

« previous php.git-pulls (#38600) next »