From d2460ef96b6c333aa8d0a11150e8be3323ac9c3e Mon Sep 17 00:00:00 2001 From: Remi Collet Date: Sat, 18 Feb 2017 16:14:07 +0100 Subject: PHP 5.4.45-13 (security fix from 5.6.30) --- bug73768.patch | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 bug73768.patch (limited to 'bug73768.patch') diff --git a/bug73768.patch b/bug73768.patch new file mode 100644 index 0000000..0244070 --- /dev/null +++ b/bug73768.patch @@ -0,0 +1,41 @@ +Backported from 5.6.30 by Remi. +Binary parts dropped + + +From b28b8b2fee6dfa6fcd13305c581bb835689ac3be Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev +Date: Fri, 30 Dec 2016 15:57:24 -0800 +Subject: [PATCH] Fix bug #73768 - Memory corruption when loading hostile phar + +--- + ext/phar/phar.c | 3 +-- + ext/phar/tests/bug73768.phar | Bin 0 -> 219 bytes + ext/phar/tests/bug73768.phpt | 16 ++++++++++++++++ + 3 files changed, 17 insertions(+), 2 deletions(-) + create mode 100644 ext/phar/tests/bug73768.phar + create mode 100644 ext/phar/tests/bug73768.phpt + +diff --git a/ext/phar/phar.c b/ext/phar/phar.c +index 532b4c3..158f417 100644 +--- a/ext/phar/phar.c ++++ b/ext/phar/phar.c +@@ -982,7 +982,6 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char + /* if the alias is stored we enforce it (implicit overrides explicit) */ + if (alias && alias_len && (alias_len != (int)tmp_len || strncmp(alias, buffer, tmp_len))) + { +- buffer[tmp_len] = '\0'; + php_stream_close(fp); + + if (signature) { +@@ -990,7 +989,7 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char + } + + if (error) { +- spprintf(error, 0, "cannot load phar \"%s\" with implicit alias \"%s\" under different alias \"%s\"", fname, buffer, alias); ++ spprintf(error, 0, "cannot load phar \"%s\" with implicit alias \"%.*s\" under different alias \"%s\"", fname, tmp_len, buffer, alias); + } + + efree(savebuf); +-- +2.1.4 + -- cgit