Skip to content

Commit 25810c5

Browse files
committed
ext/zip: guard getStream() and callback destructors against re-entrant close
Follow-up to the archive destructor use-after-free fix, plugging two more paths where a progress or cancel callback firing during zip_close() can re-enter the archive. getStream() reached php_zip_archive_addref() with the archive already being closed (refcount 0), tripping the ZEND_ASSERT(refcount > 0). Guard it with php_zipobj_closing() so the call throws "Already being closed" instead. Guard php_zip_progress_callback_free() and php_zip_cancel_callback_free() like their callback counterparts, so the FCC destructor is not run while the engine is inactive or in a bailout.
1 parent eb85883 commit 25810c5

1 file changed

Lines changed: 12 additions & 0 deletions

File tree

‎ext/zip/php_zip.c‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1128,6 +1128,10 @@ static void php_zip_progress_callback_free(void *ptr)
11281128
{
11291129
php_zip_archive *archive = ptr;
11301130

1131+
if (UNEXPECTED(!EG(active) || archive->bailout_callback)) {
1132+
return;
1133+
}
1134+
11311135
if (ZEND_FCC_INITIALIZED(archive->progress_callback)) {
11321136
zend_fcc_dtor(&archive->progress_callback);
11331137
}
@@ -1139,6 +1143,10 @@ static void php_zip_cancel_callback_free(void *ptr)
11391143
{
11401144
php_zip_archive *archive = ptr;
11411145

1146+
if (UNEXPECTED(!EG(active) || archive->bailout_callback)) {
1147+
return;
1148+
}
1149+
11421150
if (ZEND_FCC_INITIALIZED(archive->cancel_callback)) {
11431151
zend_fcc_dtor(&archive->cancel_callback);
11441152
}
@@ -3137,6 +3145,10 @@ static void php_zip_get_stream(INTERNAL_FUNCTION_PARAMETERS, int type, bool acce
31373145

31383146
ZIP_FROM_OBJECT(intern, self);
31393147

3148+
if (php_zipobj_closing(Z_ZIP_P(self))) {
3149+
RETURN_THROWS();
3150+
}
3151+
31403152
if (type) {
31413153
PHP_ZIP_STAT_PATH(intern, ZSTR_VAL(filename), ZSTR_LEN(filename), flags, sb);
31423154
} else {

0 commit comments

Comments
 (0)