diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-09-11 21:37:44 -0700 |
|---|---|---|
| committer | Ferenc Kovacs <tyra3l@gmail.com> | 2016-09-15 10:04:25 +0200 |
| commit | 71a6cff185e26d2806b551d4022e766421d3b275 (patch) | |
| tree | 99680fe7d7e5c4754977f8592fcaab8383d99620 | |
| parent | ba8f3ba05f8545a243881547dcd5a1dcfe4d4fb2 (diff) | |
| download | php-git-71a6cff185e26d2806b551d4022e766421d3b275.tar.gz | |
Fix bug #73035 (Out of bound when verify signature of tar phar in phar_parse_tarfile)
| -rw-r--r-- | ext/phar/tar.c | 2 | ||||
| -rw-r--r-- | ext/phar/tests/bug73035.phpt | 18 | ||||
| -rw-r--r-- | ext/phar/tests/bug73035.tar | bin | 0 -> 10240 bytes |
3 files changed, 19 insertions, 1 deletions
diff --git a/ext/phar/tar.c b/ext/phar/tar.c index 62edcb59f1..898ff859ab 100644 --- a/ext/phar/tar.c +++ b/ext/phar/tar.c @@ -286,7 +286,7 @@ bail: } curloc = php_stream_tell(fp); read = php_stream_read(fp, buf, size); - if (read != size) { + if (read != size || read <= 8) { if (error) { spprintf(error, 4096, "phar error: tar-based phar \"%s\" signature cannot be read", fname); } diff --git a/ext/phar/tests/bug73035.phpt b/ext/phar/tests/bug73035.phpt new file mode 100644 index 0000000000..5928428abc --- /dev/null +++ b/ext/phar/tests/bug73035.phpt @@ -0,0 +1,18 @@ +--TEST-- +Phar: #73035 (Out of bound when verify signature of tar phar in phar_parse_tarfile) +--SKIPIF-- +<?php if (!extension_loaded("phar")) die("skip"); ?> +--FILE-- +<?php +chdir(__DIR__); +try { +$phar = new PharData('bug73035.tar'); +var_dump($phar); +} catch(UnexpectedValueException $e) { + print $e->getMessage()."\n"; +} +?> +DONE +--EXPECTF-- +phar error: tar-based phar "%sbug73035.tar" signature cannot be read +DONE
\ No newline at end of file diff --git a/ext/phar/tests/bug73035.tar b/ext/phar/tests/bug73035.tar Binary files differnew file mode 100644 index 0000000000..d8e426866b --- /dev/null +++ b/ext/phar/tests/bug73035.tar |