[GIT-PULLS] [php-src] PR #22652: Fix GH-22649: avoid ZipArchive comment reset crash
[email protected] (LamentXU123)
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/22652 Author: LamentXU123 Rewrite the `PHP_ZIP_SET_FILE_COMMENT` macro to solve this uaf that occurs after overwriting an existing entry and setting its inherited unchanged comment again. I also add some defensive checks in the function by the way (`ZEND_ASSERT(comment_len <= 0xffff);`) just in case someone will re-use this helper in the future.