[php-src] PR #23779: ext/zip: fix use-after-free in the archive destructor path
| From: | jvoisin | Date: | Sat, 19 Sep 2026 21:04:06 +0000 |
| Subject: | [php-src] PR #23779: ext/zip: fix use-after-free in the archive destructor path | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38600@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23779
Author: jvoisin
Commit 132403de396 guarded php_zipobj_close() and ZipArchive::open() with the archive->close flag
so that a progress or cancel callback firing during zip_close() cannot re-enter and run a nested
zip_close() followed by zip_discard(), which frees the archive still in use.
php_zip_archive_release() was left unguarded. php_zipobj_close() sets archive->za = NULL before
calling release(), so the close() path is safe, but when a ZipArchive is destroyed without an
explicit close() the archive is finalized here with za still set. The progress/cancel callback fires
during that zip_close(), and a re-entrant close() or open() then nests zip_close() on the same
archive, causing the same use-after-free.
Set archive->close around the release-path zip_close() as well, so the re-entrant call throws
"Already being closed" instead of nesting.