Repository navigation
Commit 25810c5
committed
ext/zip: guard getStream() and callback destructors against re-entrant close
Follow-up to the archive destructor use-after-free fix, plugging two more
paths where a progress or cancel callback firing during zip_close() can
re-enter the archive.
getStream() reached php_zip_archive_addref() with the archive already being
closed (refcount 0), tripping the ZEND_ASSERT(refcount > 0). Guard it with
php_zipobj_closing() so the call throws "Already being closed" instead.
Guard php_zip_progress_callback_free() and php_zip_cancel_callback_free()
like their callback counterparts, so the FCC destructor is not run while the
engine is inactive or in a bailout.1 parent eb85883 commit 25810c5
1 file changed
Lines changed: 12 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1128 | 1128 | | |
1129 | 1129 | | |
1130 | 1130 | | |
| 1131 | + | |
| 1132 | + | |
| 1133 | + | |
| 1134 | + | |
1131 | 1135 | | |
1132 | 1136 | | |
1133 | 1137 | | |
| |||
1139 | 1143 | | |
1140 | 1144 | | |
1141 | 1145 | | |
| 1146 | + | |
| 1147 | + | |
| 1148 | + | |
| 1149 | + | |
1142 | 1150 | | |
1143 | 1151 | | |
1144 | 1152 | | |
| |||
3137 | 3145 | | |
3138 | 3146 | | |
3139 | 3147 | | |
| 3148 | + | |
| 3149 | + | |
| 3150 | + | |
| 3151 | + | |
3140 | 3152 | | |
3141 | 3153 | | |
3142 | 3154 | | |
| |||
0 commit comments