archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-20 01:14:28 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix stack underflow in phar

Browse source 
The checks can issue reads below and above the temporary buffer. A read
itself doesn't seem dangerous, but the condition result can be
arbitrary. Such reads have to be avoided. Likely this patch should be
backported.
This commit is contained in:
Anatol Belski 2018-08-06 22:35:11 +02:00
parent 3082600326
commit b053beee7e
1 changed files with 7 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

17
ext/phar/phar.c
View file

@ -1850,27 +1850,24 @@ static int phar_analyze_path(const char *fname, const char *ext, size_t ext_len,
/* check for ".phar" in extension */
static int phar_check_str(const char *fname, const char *ext_str, size_t ext_len, int executable, int for_create) /* {{{ */
{
char test[51];
const char *pos;
if (ext_len >= 50) {
return FAILURE;
}
if (executable == 1) {
/* copy "." as well */
strlcpy(test, ext_str, ext_len + 1);
/* executable phars must contain ".phar" as a valid extension (phar://.pharmy/oops is invalid) */
/* (phar://hi/there/.phar/oops is also invalid) */
pos = strstr(test, ".phar");
pos = strstr(ext_str, ".phar");
if (pos && (*(pos - 1) != '/')
&& (pos += 5) && (*pos == '\0' || *pos == '/' || *pos == '.')) {
return phar_analyze_path(fname, ext_str, ext_len, for_create);
} else {
if (!pos
|| pos != ext_str && (*(pos - 1) == '/')
|| (ext_len - (pos - ext_str)) < 5
|| !(pos += 5)
|| !(*pos == '\0' || *pos == '/' || *pos == '.')) {
return FAILURE;
}
return phar_analyze_path(fname, ext_str, ext_len, for_create);
}
/* data phars need only contain a single non-"." to be valid */