diff options
| author | Stanislav Malyshev <stas@php.net> | 2019-03-03 18:22:32 -0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2019-03-03 18:22:32 -0800 |
| commit | 7f0ab7c20c83a52862ad7c8acf31c3fa739f1274 (patch) | |
| tree | 7da92b784008d95e3f82a84087791f13de990ad1 | |
| parent | 65d81833bbd1de8c38abc591525ebce56bdbd95c (diff) | |
| download | php-git-7f0ab7c20c83a52862ad7c8acf31c3fa739f1274.tar.gz | |
Fix bug #77396 - Null Pointer Dereference in phar_create_or_parse_filename
| -rw-r--r-- | ext/phar/phar.c | 3 | ||||
| -rw-r--r-- | ext/phar/tests/bug77396.phpt | 15 |
2 files changed, 18 insertions, 0 deletions
diff --git a/ext/phar/phar.c b/ext/phar/phar.c index 0d2173195c..e117ab0dc0 100644 --- a/ext/phar/phar.c +++ b/ext/phar/phar.c @@ -1385,6 +1385,9 @@ int phar_create_or_parse_filename(char *fname, int fname_len, char *alias, int a /* set up our manifest */ mydata = ecalloc(1, sizeof(phar_archive_data)); mydata->fname = expand_filepath(fname, NULL); + if (mydata->fname == NULL) { + return FAILURE; + } fname_len = strlen(mydata->fname); #ifdef PHP_WIN32 phar_unixify_path_separators(mydata->fname, fname_len); diff --git a/ext/phar/tests/bug77396.phpt b/ext/phar/tests/bug77396.phpt new file mode 100644 index 0000000000..f7a2a2f026 --- /dev/null +++ b/ext/phar/tests/bug77396.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #77396 Relative filename exceeding maximum path length causes null pointer dereference. +--SKIPIF-- +<?php if (!extension_loaded("phar")) die("skip"); ?> +--FILE-- +<?php +$path = '../' . str_repeat("x", PHP_MAXPATHLEN) . '.tar'; +$phar = new PharData($path); +?> +--EXPECTF-- +Fatal error: Uncaught UnexpectedValueException: Phar creation or opening failed in %s/bug77396.php:%d +Stack trace: +#0 %s/bug77396.php(%d): PharData->__construct(%s) +#1 {main} + thrown in %s/bug77396.php on line %d |