1 files changed, 29 insertions, 0 deletions
diff --git a/ext/phar/tests/010.phpt b/ext/phar/tests/010.phpt
new file mode 100644
index 0000000..d1e2f40
--- /dev/null
+++ b/ext/phar/tests/010.phpt
@@ -0,0 +1,29 @@
+--TEST--
+Phar::mapPhar buffer overrun
+--SKIPIF--
+<?php if (!extension_loaded("phar")) die("skip");?>
+--INI--
+phar.require_hash=0
+--FILE--
+<?php
+$file = b"<?php
+Phar::mapPhar('hio');
+__HALT_COMPILER(); ?>";
+
+// this fails because the manifest length does not include the other 10 byte manifest data
+
+$manifest = pack('V', 1) . 'a' . pack('VVVVVV', 0, time(), 0, crc32(b''), 0x00000000, 0);
+$file .= pack('VVnVV', strlen($manifest), 1, 0x1000, 0x00000000, 3) . 'hio' . pack('V', 0) . $manifest;
+
+file_put_contents(dirname(__FILE__) . '/' . basename(__FILE__, '.php') . '.phar.php', $file);
+try {
+include dirname(__FILE__) . '/' . basename(__FILE__, '.php') . '.phar.php';
+echo file_get_contents('phar://hio/a');
+} catch (Exception $e) {
+echo $e->getMessage();
+}
+?>
+--CLEAN--
+<?php unlink(dirname(__FILE__) . '/' . basename(__FILE__, '.clean.php') . '.phar.php'); ?>
+--EXPECTF--
+internal corruption of phar "%s" (too many manifest entries for size of manifest)