diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-09-11 21:37:44 -0700 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2016-09-12 17:54:32 +0200 |
| commit | c5f34c9eca28769a3cc385501ee55bf153028dc4 (patch) | |
| tree | c63e96ea3b1510be97269d5744d4cf8ea78c592a /ext/phar | |
| parent | 27876d22ef47cd8efe6230ee5cb52ab5d650c848 (diff) | |
| download | php-git-c5f34c9eca28769a3cc385501ee55bf153028dc4.tar.gz | |
Fix bug #73035 (Out of bound when verify signature of tar phar in phar_parse_tarfile)
(cherry picked from commit 75ebf471ff46ec6e5ee279b3650c11d51ebaf9e3)
Diffstat (limited to 'ext/phar')
| -rw-r--r-- | ext/phar/tar.c | 2 | ||||
| -rw-r--r-- | ext/phar/tests/bug73035.phpt | 18 | ||||
| -rw-r--r-- | ext/phar/tests/bug73035.tar | bin | 0 -> 10240 bytes |
3 files changed, 19 insertions, 1 deletions
diff --git a/ext/phar/tar.c b/ext/phar/tar.c index aeb5c7ef1e..72b653db97 100644 --- a/ext/phar/tar.c +++ b/ext/phar/tar.c @@ -286,7 +286,7 @@ bail: } curloc = php_stream_tell(fp); read = php_stream_read(fp, buf, size); - if (read != size) { + if (read != size || read <= 8) { if (error) { spprintf(error, 4096, "phar error: tar-based phar \"%s\" signature cannot be read", fname); } diff --git a/ext/phar/tests/bug73035.phpt b/ext/phar/tests/bug73035.phpt new file mode 100644 index 0000000000..5928428abc --- /dev/null +++ b/ext/phar/tests/bug73035.phpt @@ -0,0 +1,18 @@ +--TEST-- +Phar: #73035 (Out of bound when verify signature of tar phar in phar_parse_tarfile) +--SKIPIF-- +<?php if (!extension_loaded("phar")) die("skip"); ?> +--FILE-- +<?php +chdir(__DIR__); +try { +$phar = new PharData('bug73035.tar'); +var_dump($phar); +} catch(UnexpectedValueException $e) { + print $e->getMessage()."\n"; +} +?> +DONE +--EXPECTF-- +phar error: tar-based phar "%sbug73035.tar" signature cannot be read +DONE
\ No newline at end of file diff --git a/ext/phar/tests/bug73035.tar b/ext/phar/tests/bug73035.tar Binary files differnew file mode 100644 index 0000000000..d8e426866b --- /dev/null +++ b/ext/phar/tests/bug73035.tar |