[php-src] PR #24049: phar: check php_stream_filter_create() result for bzip2.compress in phar_tar_flush() and phar_flush_ex()
| From: | ushevchenko | Date: | Thu, 01 Oct 2026 13:48:19 +0000 |
| Subject: | [php-src] PR #24049: phar: check php_stream_filter_create() result for bzip2.compress in phar_tar_flush() and phar_flush_ex() | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39036@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24049
Author: ushevchenko
**Fixes GH-24048**
The bzip2 branches of phar_tar_flush() (ext/phar/tar.c) and phar_flush_ex() (ext/phar/phar.c) pass
the result of php_stream_filter_create("bzip2.compress", ...) to
php_stream_filter_append() without checking it for NULL. The gzip branches of the same functions
already handle this case.
This adds the same check to both bzip2 branches: on failure an error message is set and EOF is
returned. In phar_tar_flush() the contents are copied uncompressed first and newfile is closed,
exactly as in the gzip branch.
With the default parameters phar passes, php_stream_filter_create() cannot realistically return NULL
here, so there is no test; this is a robustness and consistency fix.
Found by Linux Verification Center (https://portal.linuxtesting.ru) using SVACE.