Fix #78641: addGlob can modify given remove_path value

`remove_path` points to the given string, so we must not modify it. Instead we use a duplicate, if we need the modification. We may want to switch to `zend_string`s in master.

Author: cmb69

NEWS

@@ -37,6 +37,9 @@ PHP NEWS
  . Fixed bug #76859 (stream_get_line skips data if used with data-generating 
  filter). (kkopachev)
 
+- Zip:
+ . Fixed bug #78641 (addGlob can modify given remove_path value). (cmb)
+
 26 Sep 2019, PHP 7.2.23
 
 - Core:

ext/zip/php_zip.c

@@ -1667,7 +1667,7 @@ static void php_zip_add_from_pattern(INTERNAL_FUNCTION_PARAMETERS, int type) /*
 struct zip *intern;
 zval *self = getThis();
 char *path = ".";
-char *remove_path = NULL;
+char *remove_path = NULL, *save_remove_path;
 char *add_path = NULL;
 size_t add_path_len, remove_path_len = 0, path_len = 1;
 zend_long remove_all_path = 0;
@@ -1703,10 +1703,11 @@ static void php_zip_add_from_pattern(INTERNAL_FUNCTION_PARAMETERS, int type) /*
 RETURN_FALSE;
 }
 
+save_remove_path = remove_path;
 if (remove_path && remove_path_len > 1) {
 size_t real_len = strlen(remove_path);
 if ((real_len > 1) && ((remove_path[real_len - 1] == '/') || (remove_path[real_len - 1] == '\\'))) {
-remove_path[real_len - 1] = '\0';
+remove_path = estrndup(remove_path, real_len - 1);
 }
 }
 
@@ -1766,6 +1767,9 @@ static void php_zip_add_from_pattern(INTERNAL_FUNCTION_PARAMETERS, int type) /*
 }
 }
 }
+if (remove_path != save_remove_path) {
+efree(remove_path);
+}
 }
 /* }}} */
 

ext/zip/tests/bug78641.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #78641 (addGlob can modify given remove_path value)
+--SKIPIF--
+<?php
+if (!extension_loaded('zip')) die('skip zip extension not available');
+?>
+--FILE--
+<?php
+define("TMPDIR", __DIR__ . "/");
+
+$file = TMPDIR . 'bug78641';
+touch($file);
+
+$zip = new ZipArchive();
+$zip->open(TMPDIR . "bug78641.zip", ZipArchive::CREATE | ZipArchive::OVERWRITE);
+var_dump(basename(TMPDIR));
+$zip->addGlob($file, 0, ["remove_path" => TMPDIR]);
+var_dump(basename(TMPDIR));
+$zip->close();
+?>
+--EXPECT--
+string(5) "tests"
+string(5) "tests"
+--CLEAN--
+<?php
+unlink(__DIR__ . '/bug78641');
+unlink(__DIR__ . '/bug78641.zip');
+?>