diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-12-30 15:57:24 -0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2016-12-30 15:57:24 -0800 |
| commit | b28b8b2fee6dfa6fcd13305c581bb835689ac3be (patch) | |
| tree | bb8712c930d85db18e004d811b1478b37d211b9c | |
| parent | ca46d0acbce55019b970fcd4c1e8a10edfdded93 (diff) | |
| download | php-git-b28b8b2fee6dfa6fcd13305c581bb835689ac3be.tar.gz | |
Fix bug #73768 - Memory corruption when loading hostile phar
| -rw-r--r-- | ext/phar/phar.c | 3 | ||||
| -rw-r--r-- | ext/phar/tests/bug73768.phar | bin | 0 -> 219 bytes | |||
| -rw-r--r-- | ext/phar/tests/bug73768.phpt | 16 |
3 files changed, 17 insertions, 2 deletions
diff --git a/ext/phar/phar.c b/ext/phar/phar.c index 532b4c3169..158f41739d 100644 --- a/ext/phar/phar.c +++ b/ext/phar/phar.c @@ -981,7 +981,6 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char /* if the alias is stored we enforce it (implicit overrides explicit) */ if (alias && alias_len && (alias_len != (int)tmp_len || strncmp(alias, buffer, tmp_len))) { - buffer[tmp_len] = '\0'; php_stream_close(fp); if (signature) { @@ -989,7 +988,7 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char } if (error) { - spprintf(error, 0, "cannot load phar \"%s\" with implicit alias \"%s\" under different alias \"%s\"", fname, buffer, alias); + spprintf(error, 0, "cannot load phar \"%s\" with implicit alias \"%.*s\" under different alias \"%s\"", fname, tmp_len, buffer, alias); } efree(savebuf); diff --git a/ext/phar/tests/bug73768.phar b/ext/phar/tests/bug73768.phar Binary files differnew file mode 100644 index 0000000000..3f429c2365 --- /dev/null +++ b/ext/phar/tests/bug73768.phar diff --git a/ext/phar/tests/bug73768.phpt b/ext/phar/tests/bug73768.phpt new file mode 100644 index 0000000000..37a4da0253 --- /dev/null +++ b/ext/phar/tests/bug73768.phpt @@ -0,0 +1,16 @@ +--TEST-- +Phar: PHP bug #73768: Memory corruption when loading hostile phar +--SKIPIF-- +<?php if (!extension_loaded("phar")) die("skip"); ?> +--FILE-- +<?php +chdir(__DIR__); +try { +$p = Phar::LoadPhar('bug73768.phar', 'alias.phar'); +echo "OK\n"; +} catch(PharException $e) { + echo $e->getMessage(); +} +?> +--EXPECTF-- +cannot load phar "%sbug73768.phar" with implicit alias "" under different alias "alias.phar" |