ext/zip: use ZIP_RDONLY when calling zip_open() in zip_stream.c

ext/zip/tests/stats_existing.phpt

@@ -0,0 +1,39 @@
+--TEST--
+Regression tests for behavior when the requested zip does exist
+--EXTENSIONS--
+zip
+--FILE--
+<?php
+$target = __DIR__ . '/test.zip';
+
+echo "Stat:\n";
+var_dump(stat("zip://$target#entry1.txt"));
+
+echo "\nFile contents:\n";
+var_dump(file_get_contents("zip://$target#entry1.txt"));
+
+$fp = fopen("zip://$target#entry1.txt", 'rb');
+
+$fstat = fstat($fp);
+echo "\nFstat size:\n";
+var_dump($fstat['size']);
+
+echo "\nStream contents:\n";
+var_dump(stream_get_contents($fp));
+
+fclose($fp);
+?>
+--EXPECTF--
+Stat:
+
+Warning: stat(): stat failed for zip://%stest.zip#entry1.txt in %s on line %d
+bool(false)
+
+File contents:
+string(8) "entry #1"
+
+Fstat size:
+int(8)
+
+Stream contents:
+string(8) "entry #1"

ext/zip/tests/stats_missing.phpt

@@ -0,0 +1,47 @@
+--TEST--
+Regression tests for behavior when the requested zip does not exist
+--EXTENSIONS--
+zip
+--FILE--
+<?php
+$target = __DIR__ . '/target.zip';
+assert(!file_exists($target), 'target.zip should not exist at the start');
+
+echo "Stat:\n";
+var_dump(stat("zip://$target#entry.txt"));
+assert(!file_exists($target), 'target.zip should not exist after stat()');
+
+echo "\n\nFile contents:\n";
+var_dump(file_get_contents("zip://$target#entry.txt"));
+assert(!file_exists($target), 'target.zip should not exist after file_get_contents()');
+
+echo "\n\nFopen:\n";
+var_dump(fopen("zip://$target#entry.txt", 'r'));
+assert(!file_exists($target), 'target.zip should not exist after fopen() for reading');
+
+echo "\n\nOn a missing directory:\n";
+var_dump(stat('zip:///nonexistent_dir_xyz/target.zip#entry.txt'));
+?>
+--EXPECTF--
+Stat:
+
+Warning: stat(): stat failed for zip://%starget.zip#entry.txt in %s on line %d
+bool(false)
+
+
+File contents:
+
+Warning: file_get_contents(): Failed to open stream: operation failed in %s on line %d
+bool(false)
+
+
+Fopen:
+
+Warning: fopen(): Failed to open stream: operation failed in %s on line %d
+bool(false)
+
+
+On a missing directory:
+
+Warning: stat(): stat failed for zip:///nonexistent_dir_xyz/target.zip#entry.txt in %s on line %d
+bool(false)

ext/zip/tests/stats_nonzip.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Regression tests for behavior when the requested zip is not a zip file
+--EXTENSIONS--
+zip
+--FILE--
+<?php
+$target = __FILE__;
+
+echo "Stat:\n";
+var_dump(stat("zip://$target#entry1.txt"));
+
+echo "\n\nFile contents:\n";
+var_dump(file_get_contents("zip://$target#entry1.txt"));
+?>
+--EXPECTF--
+Stat:
+
+Warning: stat(): stat failed for zip://%sstats_nonzip.php#entry1.txt in %s on line %d
+bool(false)
+
+
+File contents:
+
+Warning: file_get_contents(): Failed to open stream: operation failed in %s on line %d
+bool(false)

ext/zip/zip_stream.c

@@ -162,7 +162,7 @@ static int php_zip_ops_stat(php_stream *stream, php_stream_statbuf *ssb) /* {{{
 		return -1;
 	}
 
-	za = zip_open(file_dirname, ZIP_CREATE, &err);
+	za = zip_open(file_dirname, ZIP_RDONLY, &err);
 	if (za) {
 		memset(ssb, 0, sizeof(php_stream_statbuf));
 		if (zip_stat(za, fragment, ZIP_FL_NOCASE, &sb) != 0) {
@@ -332,7 +332,7 @@ php_stream *php_stream_zip_opener(php_stream_wrapper *wrapper,
 		return NULL;
 	}
 
-	za = zip_open(file_dirname, ZIP_CREATE, &err);
+	za = zip_open(file_dirname, ZIP_RDONLY, &err);
 	if (za) {
 		zval *tmpzval;