diff options
| author | Stanislav Malyshev <stas@php.net> | 2019-03-03 23:33:48 -0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2019-03-03 23:33:48 -0800 |
| commit | 6d60ed69a107aa31c5318d47ed773fe3e9708b8c (patch) | |
| tree | 7b85399c59a1a4cc50078919ad0e7c1da00213e3 /ext/phar/tar.c | |
| parent | e3f7c352dce5c63d75976f428f7ff9a160c2be4f (diff) | |
| parent | 3e8d8f7fb36ee29a1b0fd197d88a45020a248524 (diff) | |
| download | php-git-6d60ed69a107aa31c5318d47ed773fe3e9708b8c.tar.gz | |
Merge branch 'PHP-7.2' into PHP-7.3
* PHP-7.2:
Fix bug #77586 - phar_tar_writeheaders_int() buffer overflow
Diffstat (limited to 'ext/phar/tar.c')
| -rw-r--r-- | ext/phar/tar.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/ext/phar/tar.c b/ext/phar/tar.c index 5b5b796ffe..7004676e0b 100644 --- a/ext/phar/tar.c +++ b/ext/phar/tar.c @@ -764,7 +764,12 @@ static int phar_tar_writeheaders_int(phar_entry_info *entry, void *argument) /* header.typeflag = entry->tar_type; if (entry->link) { - strncpy(header.linkname, entry->link, strlen(entry->link)); + if (strlcpy(header.linkname, entry->link, sizeof(header.linkname)) >= sizeof(header.linkname)) { + if (fp->error) { + spprintf(fp->error, 4096, "tar-based phar \"%s\" cannot be created, link \"%s\" is too long for format", entry->phar->fname, entry->link); + } + return ZEND_HASH_APPLY_STOP; + } } strncpy(header.magic, "ustar", sizeof("ustar")-1); |