Fix crash in property existence test, apply to all versions

remicollet · remicollet · commit 3e4e3054a794 · 2026-03-06T08:20:56.000+01:00
diff --git a/package.xml b/package.xml
@@ -28,6 +28,7 @@
   <license uri="https://www.php.net/license/3_01.txt" filesource="LICENSE">PHP-3.01</license>
   <notes>
 - Fixed bug GH-19932 Memory leak in zip setEncryptionName()/setEncryptionIndex() (David Carlier)
+- Fix crash in property existence test. (ndossche)
   </notes>
   <contents>
     <dir name="/">
diff --git a/php7/php_zip.c b/php7/php_zip.c
@@ -1050,9 +1050,8 @@ static int php_zip_has_property(zval *object, zval *member, int type, void **cac
 			} else if (type == 0) {
 				retval = (Z_TYPE(tmp) != IS_NULL);
 			}
+			zval_ptr_dtor(&tmp);
 		}
-
-		zval_ptr_dtor(&tmp);
 	} else {
 		std_hnd = zend_get_std_object_handlers();
 		retval = std_hnd->has_property(object, member, type, cache_slot);
diff --git a/php73/php_zip.c b/php73/php_zip.c
@@ -1054,9 +1054,8 @@ static int php_zip_has_property(zval *object, zval *member, int type, void **cac
 			} else if (type == 0) {
 				retval = (Z_TYPE(tmp) != IS_NULL);
 			}
+			zval_ptr_dtor(&tmp);
 		}
-
-		zval_ptr_dtor(&tmp);
 	} else {
 		retval = zend_std_has_property(object, member, type, cache_slot);
 	}
diff --git a/php74/php_zip.c b/php74/php_zip.c
@@ -1066,9 +1066,8 @@ static int php_zip_has_property(zval *object, zval *member, int type, void **cac
 			} else if (type == 0) {
 				retval = (Z_TYPE(tmp) != IS_NULL);
 			}
+			zval_ptr_dtor(&tmp);
 		}
-
-		zval_ptr_dtor(&tmp);
 	} else {
 		retval = zend_std_has_property(object, member, type, cache_slot);
 	}
diff --git a/php8/php_zip.c b/php8/php_zip.c
@@ -972,9 +972,8 @@ static int php_zip_has_property(zend_object *object, zend_string *name, int type
 			} else if (type == 0) {
 				retval = (Z_TYPE(tmp) != IS_NULL);
 			}
+			zval_ptr_dtor(&tmp);
 		}
-
-		zval_ptr_dtor(&tmp);
 	} else {
 		retval = zend_std_has_property(object, name, type, cache_slot);
 	}
diff --git a/php85/php_zip.c b/php85/php_zip.c
@@ -934,9 +934,8 @@ static int php_zip_has_property(zend_object *object, zend_string *name, int type
 			} else if (type == 0) {
 				retval = (Z_TYPE(tmp) != IS_NULL);
 			}
+			zval_ptr_dtor(&tmp);
 		}
-
-		zval_ptr_dtor(&tmp);
 	} else {
 		retval = zend_std_has_property(object, name, type, cache_slot);
 	}
diff --git a/tests/property_existence_test.phpt b/tests/property_existence_test.phpt
@@ -1,7 +1,9 @@
 --TEST--
 Property existence test can cause a crash
---EXTENSIONS--
-zip
+--SKIPIF--
+<?php
+if (!extension_loaded('zip')) die('skip');
+?>
 --FILE--
 <?php
 

Original file line number	Diff line number	Diff line change
`@@ -1050,9 +1050,8 @@ static int php_zip_has_property(zval object, zval member, int type, void **cac`
`1050`	`1050`	`} else if (type == 0) {`
`1051`	`1051`	`retval = (Z_TYPE(tmp) != IS_NULL);`
`1052`	`1052`	`}`
	`1053`	`+ zval_ptr_dtor(&tmp);`
`1053`	`1054`	`}`
`1054`		`-`
`1055`		`- zval_ptr_dtor(&tmp);`
`1056`	`1055`	`} else {`
`1057`	`1056`	`std_hnd = zend_get_std_object_handlers();`
`1058`	`1057`	`retval = std_hnd->has_property(object, member, type, cache_slot);`
Original file line number	Diff line number	Diff line change
`@@ -1054,9 +1054,8 @@ static int php_zip_has_property(zval object, zval member, int type, void **cac`
`1054`	`1054`	`} else if (type == 0) {`
`1055`	`1055`	`retval = (Z_TYPE(tmp) != IS_NULL);`
`1056`	`1056`	`}`
	`1057`	`+ zval_ptr_dtor(&tmp);`
`1057`	`1058`	`}`
`1058`		`-`
`1059`		`- zval_ptr_dtor(&tmp);`
`1060`	`1059`	`} else {`
`1061`	`1060`	`retval = zend_std_has_property(object, member, type, cache_slot);`
`1062`	`1061`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1066,9 +1066,8 @@ static int php_zip_has_property(zval object, zval member, int type, void **cac`
`1066`	`1066`	`} else if (type == 0) {`
`1067`	`1067`	`retval = (Z_TYPE(tmp) != IS_NULL);`
`1068`	`1068`	`}`
	`1069`	`+ zval_ptr_dtor(&tmp);`
`1069`	`1070`	`}`
`1070`		`-`
`1071`		`- zval_ptr_dtor(&tmp);`
`1072`	`1071`	`} else {`
`1073`	`1072`	`retval = zend_std_has_property(object, member, type, cache_slot);`
`1074`	`1073`	`}`
Original file line number	Diff line number	Diff line change
`@@ -972,9 +972,8 @@ static int php_zip_has_property(zend_object object, zend_string name, int type`
`972`	`972`	`} else if (type == 0) {`
`973`	`973`	`retval = (Z_TYPE(tmp) != IS_NULL);`
`974`	`974`	`}`
	`975`	`+ zval_ptr_dtor(&tmp);`
`975`	`976`	`}`
`976`		`-`
`977`		`- zval_ptr_dtor(&tmp);`
`978`	`977`	`} else {`
`979`	`978`	`retval = zend_std_has_property(object, name, type, cache_slot);`
`980`	`979`	`}`
Original file line number	Diff line number	Diff line change
`@@ -934,9 +934,8 @@ static int php_zip_has_property(zend_object object, zend_string name, int type`
`934`	`934`	`} else if (type == 0) {`
`935`	`935`	`retval = (Z_TYPE(tmp) != IS_NULL);`
`936`	`936`	`}`
	`937`	`+ zval_ptr_dtor(&tmp);`
`937`	`938`	`}`
`938`		`-`
`939`		`- zval_ptr_dtor(&tmp);`
`940`	`939`	`} else {`
`941`	`940`	`retval = zend_std_has_property(object, name, type, cache_slot);`
`942`	`941`	`}`