Fix #79797: Use of freed hash key in the phar_parse_zipfile function

We must not use heap memory after we freed it.
php · Aug 2, 2020 · 7355ab8 · 7355ab8
1 parent c68d48d
commit 7355ab8
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 1 deletion.
diff --git a/ext/phar/tests/bug79797.phar b/ext/phar/tests/bug79797.phar
diff --git a/ext/phar/tests/bug79797.phpt b/ext/phar/tests/bug79797.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #79797 (Use of freed hash key in the phar_parse_zipfile function)
+--SKIPIF--
+<?php
+if (!extension_loaded('phar')) die('skip phar extension not available');
+?>
+--INI--
+phar.cache_list={PWD}/bug79797.phar
+--FILE--
+<?php
+echo "done\n";
+?>
+--EXPECT--
+done
diff --git a/ext/phar/zip.c b/ext/phar/zip.c
@@ -703,7 +703,7 @@ int phar_parse_zipfile(php_stream *fp, char *fname, int fname_len, char *alias,
 			efree(actual_alias);
 		}
 
-		zend_hash_str_add_ptr(&(PHAR_G(phar_alias_map)), actual_alias, mydata->alias_len, mydata);
+		zend_hash_str_add_ptr(&(PHAR_G(phar_alias_map)), mydata->alias, mydata->alias_len, mydata);
 	} else {
 		phar_archive_data *fd_ptr;