archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix bug #71498: Out-of-Bound Read in phar_parse_zipfile()

Browse source
This commit is contained in:
Stanislav Malyshev 2016-02-21 16:51:05 -08:00
parent b1bd4119bc
commit a6fdc5bb27
4 changed files with 21 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
ext/phar/tests/bug71488.phpt
View file

@ -7,6 +7,7 @@ Phar: bug #71488: Stack overflow when decompressing tar archives
$p = new PharData(__DIR__."/bug71488.tar");
$newp = $p->decompress("test");
?>
DONE
--CLEAN--
<?php

17
ext/phar/tests/bug71498.phpt Normal file
View file

@ -0,0 +1,17 @@
--TEST--
Phar: bug #71498: Out-of-Bound Read in phar_parse_zipfile()
--SKIPIF--
<?php if (!extension_loaded("phar")) die("skip"); ?>
--FILE--
<?php
try {
$p = new PharData(__DIR__."/bug71498.zip");
} catch(UnexpectedValueException $e) {
echo $e->getMessage();
}
?>
DONE
--EXPECTF--
phar error: end of central directory not found in zip-based phar "%s/bug71498.zip"
DONE

BIN
ext/phar/tests/bug71498.zip Normal file
View file

Binary file not shown.

6
ext/phar/zip.c
View file

@ -159,7 +159,7 @@ static void phar_zip_u2d_time(time_t time, char *dtime, char *ddate) /* {{{ */
*
* Parse a new one and add it to the cache, returning either SUCCESS or
* FAILURE, and setting pphar to the pointer to the manifest entry
*
*
* This is used by phar_open_from_fp to process a zip-based phar, but can be called
* directly.
*/
@ -199,7 +199,7 @@ int phar_parse_zipfile(php_stream *fp, char *fname, int fname_len, char *alias,
}
while ((p=(char *) memchr(p + 1, 'P', (size_t) (size - (p + 1 - buf)))) != NULL) {
if (!memcmp(p + 1, "K\5\6", 3)) {
if ((p - buf) + sizeof(locator) <= size && !memcmp(p + 1, "K\5\6", 3)) {
memcpy((void *)&locator, (void *) p, sizeof(locator));
if (PHAR_GET_16(locator.centraldisk) != 0 || PHAR_GET_16(locator.disknumber) != 0) {
/* split archives not handled */
@ -1161,7 +1161,7 @@ int phar_zip_flush(phar_archive_data *phar, char *user_stub, long len, int defau
static const char newstub[] = "<?php // zip-based phar archive stub file\n__HALT_COMPILER();";
char halt_stub[] = "__HALT_COMPILER();";
char *tmp;
php_stream *stubfile, *oldfile;
php_serialize_data_t metadata_hash;
int free_user_stub, closeoldfile = 0;