Repository navigation
Fix GH-8469: Phar::decompressFiles() keeps compressed contents - #25045
Closed
paezraphael wants to merge 3 commits into
Closed
paezraphael wants to merge 3 commits into
paezraphael wants to merge 3 commits into
Conversation
Phar::decompressFiles() and Phar::compressFiles() only changed the compression flags of the entries. phar_flush() then read the entry contents from the archive as they were stored, so the old compressed bytes were written out as the new contents. Decompress entries whose compression changes before updating the flags, so phar_flush() writes the real contents with the new compression. Co-Authored-By: raphael paez <paezraphael@gmail.com>
Member
|
Can you please add an entry in NEWS? |
Co-Authored-By: raphael paez <paezraphael@gmail.com>
LamentXU123
requested changes
Oct 30, 2026
LamentXU123
left a comment
LamentXU123
left a comment
Member
There was a problem hiding this comment.
I don't think you can handle edgecases like
$p = new PharData(__DIR__ . '/repro.zip');
$p->addEmptyDir('dir');
$p->compressFiles(Phar::GZ);
var_dump($p->decompressFiles());
Otherwise I think its correct.
Directory entries have no contents to decompress; trying to open their file pointer failed with "local header does not match central directory" for zip-based phars. Co-Authored-By: raphael paez <paezraphael@gmail.com>
Member
|
Thanks! |
ndossche
reviewed
Oct 30, 2026
| phar_compression_args *args = (phar_compression_args *)argument; | ||
| uint32_t current = entry->flags & PHAR_ENT_COMPRESSION_MASK; | ||
|
|
||
| if (entry->is_deleted || entry->is_dir || !current || current == args->compress) { |
Member
There was a problem hiding this comment.
Is the fix complete?
It seems that the early return will break the case where recompressing with the same algorithm can still corrupt the phar file?
Member
There was a problem hiding this comment.
It seems that the early return will break the case where recompressing with the same algorithm can still corrupt the phar file?
Oh shit I didn't consider this. Nice catch.
I suppose this follow-up diff will work?
--- a/ext/phar/phar_object.c
+++ b/ext/phar/phar_object.c
@@ -3161,7 +3161,7 @@
phar_entry_info *entry = (phar_entry_info *)Z_PTR_P(zv);
uint32_t compress = *(uint32_t *)argument;
- if (entry->is_deleted) {
+ if (entry->is_deleted || (entry->flags & PHAR_ENT_COMPRESSION_MASK) == compress) {
return ZEND_HASH_APPLY_KEEP;
}
If you think its fine I will commit this directly. Sorry for missing this.
DanielEScherzer
pushed a commit
to DanielEScherzer/php-src
that referenced
this pull request
Oct 30, 2026
* PHP-8.4: Fix phpGH-8469: Phar::decompressFiles() keeps compressed contents (php#25045)
DanielEScherzer
pushed a commit
to DanielEScherzer/php-src
that referenced
this pull request
Oct 30, 2026
* PHP-8.5: Fix phpGH-8469: Phar::decompressFiles() keeps compressed contents (php#25045)
DanielEScherzer
pushed a commit
to DanielEScherzer/php-src
that referenced
this pull request
Oct 30, 2026
Follow-up to php#25045. Skip entries whose compression flags already match the requested algorithm so repeated Phar::compressFiles() calls do not corrupt their contents.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phar::decompressFiles() and Phar::compressFiles() only changed the compression flags of the entries. phar_flush() then read the entry contents from the archive as they were stored, so the old compressed bytes were written out as the new contents.
Decompress entries whose compression changes before updating the flags, so phar_flush() writes the real contents with the new compression.