diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2020-12-01 14:20:39 +0100 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2020-12-01 16:58:19 +0100 |
| commit | c283f53b24b84e0571ca2b29df05247a7344392c (patch) | |
| tree | 33b27e2b7b7d52729771aae7d4b15bd267ffd25a /NEWS | |
| parent | ecee3f1209a7c0ac9f99c7f640b2f5df56656e58 (diff) | |
| download | php-git-c283f53b24b84e0571ca2b29df05247a7344392c.tar.gz | |
Fix #73809: Phar Zip parse crash - mmap fail
Phar signatures practically are of limited size; for the MD5 and SHA
hashes the size is fixed (at most 64 bytes for SHA512); for OpenSSL
public keys there is no size limit in theory, but "64 KiB ought to be
good enough for anybody". So we check for that limit, to avoid fatal
errors due to out of memory conditions.
Since it is neither possible to have the signature compressed in the
ZIP archive, nor is it possible to manually add a signature via Phar,
we use ZipArchive to create a suitable archive for the test on the fly.
Closes GH-6474.
Diffstat (limited to 'NEWS')
| -rw-r--r-- | NEWS | 3 |
1 files changed, 3 insertions, 0 deletions
@@ -24,6 +24,9 @@ PHP NEWS . Fixed bug #80368 (OpenSSL extension fails to build against LibreSSL due to lack of OCB support). (Nikita) +- Phar: + . Fixed bug #73809 (Phar Zip parse crash - mmap fail). (cmb) + - Phpdbg: . Fixed bug #76813 (Access violation near NULL on source operand). (cmb) |