Fixed bug #71561 (NULL pointer dereference in Zip::ExtractTo)

laruence · laruence · commit f45752eb8393 · 2016-02-09T23:32:20.000+08:00
diff --git a/NEWS b/NEWS
@@ -20,6 +20,9 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed bug #70720 (strip_tags improper php code parsing). (Julien)
 
+- Zip:
+  . Fixed bug #71561 (NULL pointer dereference in Zip::ExtractTo). (Laruence)
+
 04 Feb 2016, PHP 5.6.18
 
 - Core:
diff --git a/ext/zip/php_zip.c b/ext/zip/php_zip.c
@@ -2713,7 +2713,7 @@ static ZIPARCHIVE_METHOD(extractTo)
 
 		for (i = 0; i < filecount; i++) {
 			char *file = (char*)zip_get_name(intern, i, ZIP_FL_UNCHANGED);
-			if (!php_zip_extract_file(intern, pathto, file, strlen(file) TSRMLS_CC)) {
+			if (!file || !php_zip_extract_file(intern, pathto, file, strlen(file) TSRMLS_CC)) {
 					RETURN_FALSE;
 			}
 		}

Original file line number	Diff line number	Diff line change
`@@ -2713,7 +2713,7 @@ static ZIPARCHIVE_METHOD(extractTo)`
`2713`	`2713`
`2714`	`2714`	`for (i = 0; i < filecount; i++) {`
`2715`	`2715`	`char file = (char)zip_get_name(intern, i, ZIP_FL_UNCHANGED);`
`2716`		`- if (!php_zip_extract_file(intern, pathto, file, strlen(file) TSRMLS_CC)) {`
	`2716`	`+ if (!file \|\| !php_zip_extract_file(intern, pathto, file, strlen(file) TSRMLS_CC)) {`
`2717`	`2717`	`RETURN_FALSE;`
`2718`	`2718`	`}`
`2719`	`2719`	`}`