From 11dda9a4fb4106bb2f35a717ca0bfb379fa7d1ad Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Sun, 3 Mar 2019 22:33:38 -0800 Subject: [PATCH] Fix bug #77586 - phar_tar_writeheaders_int() buffer overflow (cherry picked from commit e0f5d62bd6690169998474b62f92a8c5ddf0e699) --- ext/phar/tar.c | 7 ++++++- ext/phar/tests/bug71488.phpt | 5 +++-- ext/phar/tests/bug77586.phpt | 21 +++++++++++++++++++ ...-dne29hvpNWXiVbepwIf8-NRHWM9LITLo3nXZnKVNC | 1 + 4 files changed, 31 insertions(+), 3 deletions(-) create mode 100644 ext/phar/tests/bug77586.phpt create mode 100644 ext/phar/tests/bug77586/files/link-nktarAMLdJBv7BGYnpzg-ZDycSpWN3Ne3kacltOSE-EqfhStJ1EoBpGuoua6VE-dne29hvpNWXiVbepwIf8-NRHWM9LITLo3nXZnKVNC diff --git a/ext/phar/tar.c b/ext/phar/tar.c index 898ff859ab..7ad95ebba6 100644 --- a/ext/phar/tar.c +++ b/ext/phar/tar.c @@ -765,7 +765,12 @@ static int phar_tar_writeheaders(void *pDest, void *argument TSRMLS_DC) /* {{{ * header.typeflag = entry->tar_type; if (entry->link) { - strncpy(header.linkname, entry->link, strlen(entry->link)); + if (strlcpy(header.linkname, entry->link, sizeof(header.linkname)) >= sizeof(header.linkname)) { + if (fp->error) { + spprintf(fp->error, 4096, "tar-based phar \"%s\" cannot be created, link \"%s\" is too long for format", entry->phar->fname, entry->link); + } + return ZEND_HASH_APPLY_STOP; + } } strncpy(header.magic, "ustar", sizeof("ustar")-1); diff --git a/ext/phar/tests/bug71488.phpt b/ext/phar/tests/bug71488.phpt index 22d2bf098f..65bd7b2d3c 100644 --- a/ext/phar/tests/bug71488.phpt +++ b/ext/phar/tests/bug71488.phpt @@ -13,5 +13,6 @@ DONE ---EXPECT-- -DONE \ No newline at end of file +--EXPECTF-- +Fatal error: Uncaught BadMethodCallException: tar-based phar "%s/bug71488.test" cannot be created, link "%s" is too long for format in %sbug71488.php:%d +Stack trace:%A diff --git a/ext/phar/tests/bug77586.phpt b/ext/phar/tests/bug77586.phpt new file mode 100644 index 0000000000..039cc16994 --- /dev/null +++ b/ext/phar/tests/bug77586.phpt @@ -0,0 +1,21 @@ +--TEST-- +Bug #77586 Symbolic link names in tar-formatted phar must be less than 100 bytes. +--SKIPIF-- + +--FILE-- +buildFromDirectory($dir . "/files"); +?> +--CLEAN-- + +--EXPECTF-- +Fatal error: Uncaught PharException: tar-based phar "%s/bug77586.tar" cannot be created, link "%s" is too long for format %s +Stack trace: +#0 %s/bug77586.php(%d): PharData->buildFromDirectory('%s') +#1 {main} + thrown in %s/bug77586.php %s on line %d diff --git a/ext/phar/tests/bug77586/files/link-nktarAMLdJBv7BGYnpzg-ZDycSpWN3Ne3kacltOSE-EqfhStJ1EoBpGuoua6VE-dne29hvpNWXiVbepwIf8-NRHWM9LITLo3nXZnKVNC b/ext/phar/tests/bug77586/files/link-nktarAMLdJBv7BGYnpzg-ZDycSpWN3Ne3kacltOSE-EqfhStJ1EoBpGuoua6VE-dne29hvpNWXiVbepwIf8-NRHWM9LITLo3nXZnKVNC new file mode 100644 index 0000000000..1de565933b --- /dev/null +++ b/ext/phar/tests/bug77586/files/link-nktarAMLdJBv7BGYnpzg-ZDycSpWN3Ne3kacltOSE-EqfhStJ1EoBpGuoua6VE-dne29hvpNWXiVbepwIf8-NRHWM9LITLo3nXZnKVNC @@ -0,0 +1 @@ +target \ No newline at end of file From 426ecc2f86e65a6105d510569b9f7bbbe67f765a Mon Sep 17 00:00:00 2001 From: Anatol Belski Date: Wed, 6 Mar 2019 12:48:42 +0100 Subject: [PATCH] Fix test --- ext/phar/tests/bug71488.phpt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ext/phar/tests/bug71488.phpt b/ext/phar/tests/bug71488.phpt index 65bd7b2d3c..8468ce212a 100644 --- a/ext/phar/tests/bug71488.phpt +++ b/ext/phar/tests/bug71488.phpt @@ -14,5 +14,5 @@ DONE @unlink(__DIR__."/bug71488.test"); ?> --EXPECTF-- -Fatal error: Uncaught BadMethodCallException: tar-based phar "%s/bug71488.test" cannot be created, link "%s" is too long for format in %sbug71488.php:%d +Fatal error: Uncaught exception 'BadMethodCallException' with message 'tar-based phar "%sbug71488.test" cannot be created, link "%s" is too long for format' in %sbug71488.php:%d Stack trace:%A