php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #79296 ZipArchive::open fails on empty file (libzip 1.6.0)
Submitted: 2020-02-22 11:10 UTC Modified: 2020-03-19 16:30 UTC
Votes:1
Avg. Score:4.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:0 (0.0%)
From: dunglas at gmail dot com Assigned:
Status: Closed Package: Zip Related
PHP Version: 7.4.3 OS: Mac OS X
Private report: No CVE-ID: None
 [2020-02-22 11:10 UTC] dunglas at gmail dot com
Description:
------------
Creating a Zip archive in the default temporary directory of Mac OS doesn't work with Mac OS Catalina.

Using the default TMPDIR to store temporary Zip archive, is a common practice. For instance it's what PHP WebDriver does by default to create a temporary Firefox profile.

Using the OVERWRITE flag of libzip instead of the CREATE one fixes the problem.
This may be due do to the new security features introduced in Mac OS Catalina.

Tested with PHP 7.4 and 8.0-dev, but this bug probably affects all versions.

Test script:
---------------
<?php

$f = tempnam(sys_get_temp_dir(), 'WebDriverFirefoxProfileZip');


$zip = new ZipArchive();
$success = $zip->open($f, ZipArchive::CREATE);
// this work
// $success = $zip->open($f, ZipArchive::OVERWRITE);
if ($success !== true) {
    die('Error code '.$success);
}
$zip->addFile(__DIR__.'/foo.txt', '/foo.txt');
$zip->close();


Expected result:
----------------
No errors

Actual result:
--------------
Error 19

#define ZIP_ER_NOZIP 19           /* N Not a zip archive */


Patches

Add a Patch

Pull Requests

Pull requests:

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2020-03-10 15:20 UTC] dv dot sum0 at gmail dot com
We saw the same issue on a Centos 7 machine, changed between 7.4.2 and 7.4.3

It seems to be caused by the fact that the tempnam() function creates an empty file immediately, if you use a different filename that doesn't already exist it works as expected.
 [2020-03-19 13:30 UTC] remi@php.net
This is not a change in PHP nor ZIP extension, but in libzip 1.6.0, from Changelog

* Do not accept empty files as valid zip archives any longer.


So indeed your code have to be adapted.


I propose to close as "not a bug"
 [2020-03-19 13:30 UTC] remi@php.net
-Status: Open +Status: Feedback
 [2020-03-19 16:30 UTC] remi@php.net
-Summary: ZipArchive::open with ZipArchive::CREATE flag fail when in the Mac OS TMPDIR +Summary: ZipArchive::open fails on empty file (libzip 1.6.0)
 [2020-03-19 16:38 UTC] remi@php.net
The following pull request has been associated:

Patch Name: Fix Bug #79296 ZipArchive::open fails on empty file
On GitHub:  https://github.com/php/php-src/pull/5281
Patch:      https://github.com/php/php-src/pull/5281.patch
 [2020-03-19 16:39 UTC] remi@php.net
BTW, if I still don't know if we should fixed this issue, a possible mitigation is proposed in linked PR.
 [2020-03-20 10:19 UTC] remi@php.net
Automatic comment on behalf of remi@remirepo.net
Revision: http://git.php.net/?p=php-src.git;a=commit;h=8aab43c85d67fc1c1935f91bc64db800c4ef4754
Log: Fix Bug #79296 ZipArchive::open fails on empty file
 [2020-03-20 10:19 UTC] remi@php.net
-Status: Feedback +Status: Closed
 [2020-03-20 10:39 UTC] remi@php.net
NOTICE: the workaround implemented for this issue is only valid for PHP 7.3 and 7.4

PHP 8.0 will raise a deprecation warning

PHP 9.0 will follow libzip default behavior
 
PHP Copyright © 2001-2020 The PHP Group
All rights reserved.
Last updated: Sat Oct 31 20:01:24 2020 UTC