new test, better naming of tests

10 files changed, 56 insertions, 18 deletions

diff --git a/ext/phar/phar.c b/ext/phar/phar.c
index 6b5e0d1bd4..aa77831aac 100644
--- a/ext/phar/phar.c
+++ b/ext/phar/phar.c
@@ -109,7 +109,7 @@ PHP_METHOD(PHP_Archive, canCompress)
  */
 PHP_METHOD(PHP_Archive, mapPhar)
 {
-	char *fname, *myalias, *alias, *buffer, *endbuffer, *unpack_var, *savebuf;
+	char *fname, *alias, *buffer, *endbuffer, *unpack_var, *savebuf;
 	phar_file_data mydata;
 	zend_bool compressed;
 	phar_manifest_entry entry;
@@ -260,6 +260,9 @@ PHP_METHOD(PHP_Archive, mapPhar)
 		PHAR_GET_VAL(entry.timestamp)
 		PHAR_GET_VAL(entry.offset_within_phar)
 		PHAR_GET_VAL(entry.compressed_filesize)
+		if (entry.compressed_filesize < 9) {
+			MAPPHAR_FAIL("internal corruption of phar \"%s\" (file size in phar is not large enough)")
+		}
 		zend_hash_add(manifest, entry.filename, entry.filename_len, &entry,
 			sizeof(phar_manifest_entry), NULL);
 	}
@@ -489,7 +492,7 @@ static int phar_postprocess_file(char *contents, php_uint32 nr, unsigned long cr
 		PHAR_GET_VAL(crc32)
 		PHAR_GET_VAL(actual_length)
 		if (actual_length != nr) {
-			return -1;
+			return -2;
 		}
 	}
 
@@ -515,9 +518,12 @@ PHP_PHAR_API php_stream * php_stream_phar_url_wrapper(php_stream_wrapper *wrappe
 	char *buffer;
 	php_url *resource = NULL;
 	php_stream *fp;
+	int status;
 #ifdef HAVE_PHAR_ZLIB
+	unsigned long crc32;
+	php_uint32 actual_length, i;
+	char *unpack_var, *savebuf;
 	/* borrowed from zlib.c gzinflate() function */
-	int status;
 	php_uint32 offset;
 	unsigned long length;
 	char *s1=NULL;
@@ -594,9 +600,6 @@ PHP_PHAR_API php_stream * php_stream_phar_url_wrapper(php_stream_wrapper *wrappe
 			return NULL;
 		}
 		php_stream_close(fp);
-		unsigned long crc32;
-		php_uint32 actual_length, i;
-		char *unpack_var, *savebuf;
 		savebuf = buffer;
 		#define PHAR_GET_VAL(var)			\
 			unpack_var = (char *) &var;		\
@@ -668,10 +671,17 @@ PHP_PHAR_API php_stream * php_stream_phar_url_wrapper(php_stream_wrapper *wrappe
 			PHAR_ZLIB_ERROR
 			php_error_docref(NULL TSRMLS_CC, E_ERROR, "phar error: internal corruption of phar \"%s\" (filesize mismatch on file \"%s\")", buffer, internal_file);
 		}
-		/* check crc32 */
-		if (-1 == phar_postprocess_file(idata->file, idata->internal_file->uncompressed_filesize, crc32, 0)) {
+		/* check crc32/filesize */
+		status = phar_postprocess_file(idata->file, idata->internal_file->uncompressed_filesize, crc32, 0);
+		if (-1 == status) {
 			PHAR_ZLIB_ERROR
-			php_error_docref(NULL TSRMLS_CC, E_ERROR, "phar error: internal corruption of phar \"%s\" (crc32 mismatch on file \"%s\")", buffer, internal_file);
+					php_error_docref(NULL TSRMLS_CC, E_ERROR, "phar error: internal corruption of phar \"%s\" (crc32 mismatch on file \"%s\")", buffer, internal_file);
+			return NULL;
+		}
+		if (-2 == status) {
+			PHAR_ZLIB_ERROR
+					php_error_docref(NULL TSRMLS_CC, E_ERROR, "phar error: internal corruption of phar \"%s\" (filesize mismatch on file \"%s\")", buffer, internal_file);
+			return NULL;
 		}
 #else
 		php_error_docref(NULL TSRMLS_CC, E_ERROR, "zlib extension must be enabled for compressed .phar files");
@@ -690,13 +700,21 @@ PHP_PHAR_API php_stream * php_stream_phar_url_wrapper(php_stream_wrapper *wrappe
 		}
 		php_stream_close(fp);
 		/* check length, crc32 */
-		if (-1 == phar_postprocess_file(idata->file, idata->internal_file->uncompressed_filesize, 0, 1)) {
+		status = phar_postprocess_file(idata->file, idata->internal_file->uncompressed_filesize, 0, 1);
+		if (-1 == status) {
 			efree(idata->file);
 			buffer = idata->data->file;
 			efree(idata);
 			php_error_docref(NULL TSRMLS_CC, E_ERROR, "phar error: internal corruption of phar \"%s\" (crc32 mismatch on file \"%s\")", buffer, internal_file);
 			return NULL;
 		}
+		if (-2 == status) {
+			efree(idata->file);
+			buffer = idata->data->file;
+			efree(idata);
+			php_error_docref(NULL TSRMLS_CC, E_ERROR, "phar error: internal corruption of phar \"%s\" (filesize mismatch on file \"%s\")", buffer, internal_file);
+			return NULL;
+		}
 		memmove(idata->file, idata->file + 8, idata->internal_file->uncompressed_filesize);
 	}
 
diff --git a/ext/phar/tests/002.phpt b/ext/phar/tests/002.phpt
index db5d42f28d..703dcff23c 100644
--- a/ext/phar/tests/002.phpt
+++ b/ext/phar/tests/002.phpt
@@ -1,5 +1,5 @@
 --TEST--
-PHP_Archive::mapPhar improper parameters
+PHP_Archive::mapPhar truncated manifest/improper params
 --SKIPIF--
 <?php if (!extension_loaded("phar")) print "skip"; ?>
 --FILE--
diff --git a/ext/phar/tests/003.phpt b/ext/phar/tests/003.phpt
index d09c6ddaeb..e5619e7fd2 100644
--- a/ext/phar/tests/003.phpt
+++ b/ext/phar/tests/003.phpt
@@ -1,5 +1,5 @@
 --TEST--
-PHP_Archive::mapPhar improper parameters
+PHP_Archive::mapPhar zlib not loaded
 --SKIPIF--
 <?php if (!extension_loaded("phar")) print "skip";
 if (PHP_Archive::canCompress()) print "skip";?>
diff --git a/ext/phar/tests/004.phpt b/ext/phar/tests/004.phpt
index 02beb8a784..f3ead7f3f5 100644
--- a/ext/phar/tests/004.phpt
+++ b/ext/phar/tests/004.phpt
@@ -1,5 +1,5 @@
 --TEST--
-PHP_Archive::mapPhar improper parameters
+PHP_Archive::mapPhar no __HALT_COMPILER();
 --SKIPIF--
 <?php if (!extension_loaded("phar")) print "skip";?>
 --FILE--
diff --git a/ext/phar/tests/005.phpt b/ext/phar/tests/005.phpt
index 62f761f986..2cc46cf827 100644
--- a/ext/phar/tests/005.phpt
+++ b/ext/phar/tests/005.phpt
@@ -1,5 +1,5 @@
 --TEST--
-PHP_Archive::mapPhar improper parameters
+PHP_Archive::mapPhar truncated manifest (none)
 --SKIPIF--
 <?php if (!extension_loaded("phar")) print "skip";?>
 --FILE--
diff --git a/ext/phar/tests/006.phpt b/ext/phar/tests/006.phpt
index d66f2efede..973e6066d2 100644
--- a/ext/phar/tests/006.phpt
+++ b/ext/phar/tests/006.phpt
@@ -1,5 +1,5 @@
 --TEST--
-PHP_Archive::mapPhar improper parameters
+PHP_Archive::mapPhar truncated manifest (manifest length truncated)
 --SKIPIF--
 <?php if (!extension_loaded("phar")) print "skip";?>
 --FILE--
diff --git a/ext/phar/tests/007.phpt b/ext/phar/tests/007.phpt
index 4772364d81..409a2d63dc 100644
--- a/ext/phar/tests/007.phpt
+++ b/ext/phar/tests/007.phpt
@@ -1,5 +1,5 @@
 --TEST--
-PHP_Archive::mapPhar improper parameters
+PHP_Archive::mapPhar manifest too big
 --SKIPIF--
 <?php if (!extension_loaded("phar")) print "skip";?>
 --FILE--
diff --git a/ext/phar/tests/008.phpt b/ext/phar/tests/008.phpt
index 9038512112..f517fde662 100644
--- a/ext/phar/tests/008.phpt
+++ b/ext/phar/tests/008.phpt
@@ -1,5 +1,5 @@
 --TEST--
-PHP_Archive::mapPhar improper parameters
+PHP_Archive::mapPhar truncated manifest (not enough for manifest length)
 --SKIPIF--
 <?php if (!extension_loaded("phar")) print "skip";?>
 --FILE--
diff --git a/ext/phar/tests/009.phpt b/ext/phar/tests/009.phpt
index d2de92dbb1..66f5701089 100644
--- a/ext/phar/tests/009.phpt
+++ b/ext/phar/tests/009.phpt
@@ -1,5 +1,5 @@
 --TEST--
-PHP_Archive::mapPhar improper parameters
+PHP_Archive::mapPhar too many manifest entries
 --SKIPIF--
 <?php if (!extension_loaded("phar")) print "skip";?>
 --FILE--
diff --git a/ext/phar/tests/013.phpt b/ext/phar/tests/013.phpt
new file mode 100644
index 0000000000..d4d08985a5
--- /dev/null
+++ b/ext/phar/tests/013.phpt
@@ -0,0 +1,20 @@
+--TEST--
+PHP_Archive::mapPhar filesize mismatch
+--SKIPIF--
+<?php if (!extension_loaded("phar")) print "skip";?>
+--FILE--
+<?php
+function cleanup() { unlink(dirname(__FILE__) . '/008_phar.php'); }
+register_shutdown_function('cleanup');
+$file = "<?php
+PHP_Archive::mapPhar(5, 'hio', false);
+__HALT_COMPILER(); ?>";
+// compressed file length does not include 8 bytes for crc/file length and should
+$manifest = pack('V', 1) . 'a' . pack('VVVV', 1, time(), 0, 9);
+$file .= pack('VV', strlen($manifest) + 4, 1) . $manifest . pack('VV', crc32('a'), 2) . 'a';
+file_put_contents(dirname(__FILE__) . '/008_phar.php', $file);
+include dirname(__FILE__) . '/008_phar.php';
+echo file_get_contents('phar://hio/a');
+?>
+--EXPECTF--
+Fatal error: file_get_contents(): phar error: internal corruption of phar "%s" (filesize mismatch on file "a") in %s on line 12
\ No newline at end of file