archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-20 09:24:05 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix stack underflow in phar

Browse source 
The checks can issue reads below and above the temporary buffer. A read
itself doesn't seem dangerous, but the condition result can be
arbitrary. Such reads have to be avoided. Likely this patch should be
backported.
This commit is contained in:
Anatol Belski 2018-08-06 22:35:11 +02:00
parent 3082600326
commit b053beee7e
1 changed files with 7 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

17
ext/phar/phar.c
View file

@ -1850,27 +1850,24 @@ static int phar_analyze_path(const char *fname, const char *ext, size_t ext_len,
/* check for ".phar" in extension */ /* check for ".phar" in extension */
static int phar_check_str(const char *fname, const char *ext_str, size_t ext_len, int executable, int for_create) /* {{{ */ static int phar_check_str(const char *fname, const char *ext_str, size_t ext_len, int executable, int for_create) /* {{{ */
{ {
char test[51];
const char *pos; const char *pos;
if (ext_len >= 50) { if (ext_len >= 50) {
return FAILURE; return FAILURE;
} }
if (executable == 1) { if (executable == 1) {
/* copy "." as well */
strlcpy(test, ext_str, ext_len + 1);
/* executable phars must contain ".phar" as a valid extension (phar://.pharmy/oops is invalid) */ /* executable phars must contain ".phar" as a valid extension (phar://.pharmy/oops is invalid) */
/* (phar://hi/there/.phar/oops is also invalid) */ /* (phar://hi/there/.phar/oops is also invalid) */
pos = strstr(test, ".phar"); pos = strstr(ext_str, ".phar");
if (pos && (*(pos - 1) != '/') if (!pos
&& (pos += 5) && (*pos == '\0' || *pos == '/' || *pos == '.')) { || pos != ext_str && (*(pos - 1) == '/')
return phar_analyze_path(fname, ext_str, ext_len, for_create); || (ext_len - (pos - ext_str)) < 5
} else { || !(pos += 5)
|| !(*pos == '\0' || *pos == '/' || *pos == '.')) {
return FAILURE; return FAILURE;
} }
return phar_analyze_path(fname, ext_str, ext_len, for_create);
} }
/* data phars need only contain a single non-"." to be valid */ /* data phars need only contain a single non-"." to be valid */