archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fixed bug #71331 - Uninitialized pointer in phar_make_dirstream()

Browse source
This commit is contained in:
Stanislav Malyshev 2016-01-14 22:58:40 -08:00
parent d7f8d9e3a9
commit 4c2424eb24
4 changed files with 18 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
ext/phar/dirstream.c
View file

@ -198,12 +198,13 @@ static php_stream *phar_make_dirstream(char *dir, HashTable *manifest TSRMLS_DC)
zend_hash_internal_pointer_reset(manifest);
while (FAILURE != zend_hash_has_more_elements(manifest)) {
keylen = 0;
if (HASH_KEY_NON_EXISTENT == zend_hash_get_current_key_ex(manifest, &str_key, &keylen, &unused, 0, NULL)) {
break;
}
if (keylen <= (uint)dirlen) {
if (keylen < (uint)dirlen || !strncmp(str_key, dir, dirlen)) {
if (keylen == 0 || keylen < (uint)dirlen || !strncmp(str_key, dir, dirlen)) {
if (SUCCESS != zend_hash_move_forward(manifest)) {
break;
}

2
ext/phar/tar.c
View file

@ -348,7 +348,7 @@ bail:
entry.filename_len = entry.uncompressed_filesize;
/* Check for overflow - bug 61065 */
if (entry.filename_len == UINT_MAX) {
if (entry.filename_len == UINT_MAX || entry.filename_len == 0) {
if (error) {
spprintf(error, 4096, "phar error: \"%s\" is a corrupted tar file (invalid entry size)", fname);
}

15
ext/phar/tests/bug71331.phpt Normal file
View file

@ -0,0 +1,15 @@
--TEST--
Bug #71331 (Uninitialized pointer in phar_make_dirstream())
--SKIPIF--
<?php if (!extension_loaded("phar")) die("skip"); ?>
--FILE--
<?php
$p = new PharData(__DIR__."/bug71331.tar");
?>
DONE
--EXPECTF--
Fatal error: Uncaught exception 'UnexpectedValueException' with message 'phar error: "%s/bug71331.tar" is a corrupted tar file (invalid entry size)' in %s/bug71331.php:2
Stack trace:
#0 %s/bug71331.php(2): PharData->__construct('%s')
#1 {main}
thrown in %s/bug71331.php on line 2

BIN
ext/phar/tests/bug71331.tar Normal file
View file

Binary file not shown.