Skip to content

Commit 5a2a150

Browse files
committed
Merge branch 'PHP-8.4'
* PHP-8.4: Fix phar crash and file corruption with SplFileObject
2 parents 4d27420 + 2aeefb1 commit 5a2a150

File tree

4 files changed

+29
-4
lines changed

4 files changed

+29
-4
lines changed

ext/phar/phar.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2708,7 +2708,7 @@ void phar_flush_ex(phar_archive_data *phar, zend_string *user_stub, bool is_defa
27082708
/* remove this from the new phar */
27092709
continue;
27102710
}
2711-
if (!entry->is_modified && entry->fp_refcount) {
2711+
if (entry->fp_refcount) {
27122712
/* open file pointers refer to this fp, do not free the stream */
27132713
switch (entry->fp_type) {
27142714
case PHAR_FP:

ext/phar/stream.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -445,12 +445,12 @@ static ssize_t phar_stream_write(php_stream *stream, const char *buf, size_t cou
445445
{
446446
phar_entry_data *data = (phar_entry_data *) stream->abstract;
447447

448-
php_stream_seek(data->fp, data->position, SEEK_SET);
448+
php_stream_seek(data->fp, data->position + data->zero, SEEK_SET);
449449
if (count != php_stream_write(data->fp, buf, count)) {
450450
php_stream_wrapper_log_error(stream->wrapper, stream->flags, "phar error: Could not write %d characters to \"%s\" in phar \"%s\"", (int) count, ZSTR_VAL(data->internal_file->filename), data->phar->fname);
451451
return -1;
452452
}
453-
data->position = php_stream_tell(data->fp);
453+
data->position = php_stream_tell(data->fp) - data->zero;
454454
if (data->position > (zend_off_t)data->internal_file->uncompressed_filesize) {
455455
data->internal_file->uncompressed_filesize = data->position;
456456
}

ext/phar/tar.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -841,7 +841,7 @@ static int phar_tar_writeheaders_int(phar_entry_info *entry, void *argument) /*
841841
php_stream_write(fp->new, padding, ((entry->uncompressed_filesize +511)&~511) - entry->uncompressed_filesize);
842842
}
843843

844-
if (!entry->is_modified && entry->fp_refcount) {
844+
if (entry->fp_refcount) {
845845
/* open file pointers refer to this fp, do not free the stream */
846846
switch (entry->fp_type) {
847847
case PHAR_FP:

ext/phar/tests/gh19038.phpt

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
--TEST--
2+
GH-19038 (Phar crash and data corruption with SplFileObject)
3+
--EXTENSIONS--
4+
phar
5+
--INI--
6+
phar.readonly=0
7+
--FILE--
8+
<?php
9+
10+
$phar = new Phar(__DIR__ . "/gh19038.phar");
11+
$phar->addFromString("file", "123");
12+
$file = $phar["file"]->openFile();
13+
$file->fseek(3);
14+
var_dump($file->fwrite("456", 3));
15+
$file->fseek(0);
16+
echo $file->fread(100);
17+
18+
?>
19+
--CLEAN--
20+
<?php
21+
@unlink(__DIR__ . "/gh19038.phar");
22+
?>
23+
--EXPECT--
24+
int(3)
25+
123456

0 commit comments

Comments
 (0)