diff options
| author | Stanislav Malyshev <stas@php.net> | 2015-04-29 22:04:20 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2015-04-29 22:51:43 -0700 |
| commit | c27f012b7a447e59d4a704688971cbfa7dddaa74 (patch) | |
| tree | 7d4d6a70e99cbcafd79d36e6a7dacf44ee616fa7 | |
| parent | ac2832935435556dc593784cd0087b5e576bbe4d (diff) | |
| download | php-git-c27f012b7a447e59d4a704688971cbfa7dddaa74.tar.gz | |
Fix bug #69453 - don't try to cut empty string
| -rw-r--r-- | ext/phar/tar.c | 2 | ||||
| -rw-r--r-- | ext/phar/tests/bug69453.phpt | 21 |
2 files changed, 22 insertions, 1 deletions
diff --git a/ext/phar/tar.c b/ext/phar/tar.c index ca8eafcc8a..d6d63e6599 100644 --- a/ext/phar/tar.c +++ b/ext/phar/tar.c @@ -425,7 +425,7 @@ bail: entry.filename_len = i; entry.filename = pestrndup(hdr->name, i, myphar->is_persistent); - if (entry.filename[entry.filename_len - 1] == '/') { + if (i > 0 && entry.filename[entry.filename_len - 1] == '/') { /* some tar programs store directories with trailing slash */ entry.filename[entry.filename_len - 1] = '\0'; entry.filename_len--; diff --git a/ext/phar/tests/bug69453.phpt b/ext/phar/tests/bug69453.phpt new file mode 100644 index 0000000000..4a2a37f00a --- /dev/null +++ b/ext/phar/tests/bug69453.phpt @@ -0,0 +1,21 @@ +--TEST-- +Phar: bug #69453: Memory Corruption in phar_parse_tarfile when entry filename starts with null +--SKIPIF-- +<?php if (!extension_loaded("phar")) die("skip"); ?> +--FILE-- +<?php +$fname = dirname(__FILE__) . '/bug69453.tar.phar'; +try { +$r = new Phar($fname, 0); +} catch(UnexpectedValueException $e) { + echo $e; +} +?> + +==DONE== +--EXPECTF-- +exception 'UnexpectedValueException' with message 'phar error: "%s/bug69453.tar.phar" is a corrupted tar file (checksum mismatch of file "")' in %s:%d +Stack trace: +#0 %s/bug69453.php(%d): Phar->__construct('%s', 0) +#1 {main} +==DONE==
\ No newline at end of file |