diff --git a/NEWS b/NEWS index 95a0ab97ee1f..caddbd717490 100644 --- a/NEWS +++ b/NEWS @@ -34,6 +34,10 @@ PHP NEWS . Fixed bug GH-21468 (Segfault in file_get_contents w/ a https URL and a proxy set). (CVE-2026-12184) (ndossche) +- Zip: + . Fixed bug GH-21705 (ZipArchive::getFromIndex() ignores + ZipArchive::FL_UNCHANGED for deleted entries). (Weilin Du) + 02 Jul 2026, PHP 8.6.0alpha1 - Core: diff --git a/ext/zip/php_zip.c b/ext/zip/php_zip.c index f231b3ad9ef2..5df4d47740a8 100644 --- a/ext/zip/php_zip.c +++ b/ext/zip/php_zip.c @@ -2870,7 +2870,7 @@ static void php_zip_get_from(INTERNAL_FUNCTION_PARAMETERS, int type) /* {{{ */ ZIP_FROM_OBJECT(intern, self); - PHP_ZIP_STAT_INDEX(intern, index, 0, sb); + PHP_ZIP_STAT_INDEX(intern, index, flags, sb); } if (sb.size < 1) { diff --git a/ext/zip/tests/bug_gh21705.phpt b/ext/zip/tests/bug_gh21705.phpt new file mode 100644 index 000000000000..41dabb224510 --- /dev/null +++ b/ext/zip/tests/bug_gh21705.phpt @@ -0,0 +1,33 @@ +--TEST-- +ZipArchive::getFromIndex() honors FL_UNCHANGED for deleted entries +--EXTENSIONS-- +zip +--FILE-- +open($name, ZipArchive::CREATE); +$zip->addFromString('foo.txt', 'foo'); +$zip->addFromString('bar.txt', 'bar'); +$zip->close(); + +$zip = new ZipArchive; +$zip->open($name); + +$index = $zip->locateName('bar.txt'); +$zip->deleteName('bar.txt'); + +var_dump($zip->getFromName('bar.txt', 0, ZipArchive::FL_UNCHANGED)); +var_dump($zip->getFromIndex($index, 0, ZipArchive::FL_UNCHANGED)); + +$zip->close(); +?> +--CLEAN-- + +--EXPECT-- +string(3) "bar" +string(3) "bar"