summaryrefslogtreecommitdiffstats
path: root/bug73768.patch
blob: b8d2b9a3b632910eea062dccdc31fe07a10c89d4 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
Backported from 5.6.30 by Remi.
Binary parts dropped


From b28b8b2fee6dfa6fcd13305c581bb835689ac3be Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Fri, 30 Dec 2016 15:57:24 -0800
Subject: [PATCH] Fix bug #73768 - Memory corruption when loading hostile phar

---
 ext/phar/phar.c              |   3 +--
 ext/phar/tests/bug73768.phar | Bin 0 -> 219 bytes
 ext/phar/tests/bug73768.phpt |  16 ++++++++++++++++
 3 files changed, 17 insertions(+), 2 deletions(-)
 create mode 100644 ext/phar/tests/bug73768.phar
 create mode 100644 ext/phar/tests/bug73768.phpt

diff --git a/ext/phar/phar.c b/ext/phar/phar.c
index 532b4c3..158f417 100644
--- a/ext/phar/phar.c
+++ b/ext/phar/phar.c
@@ -981,7 +981,6 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 		/* if the alias is stored we enforce it (implicit overrides explicit) */
 		if (alias && alias_len && (alias_len != (int)tmp_len || strncmp(alias, buffer, tmp_len)))
 		{
-			buffer[tmp_len] = '\0';
 			php_stream_close(fp);
 
 			if (signature) {
@@ -989,7 +988,7 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 			}
 
 			if (error) {
-				spprintf(error, 0, "cannot load phar \"%s\" with implicit alias \"%s\" under different alias \"%s\"", fname, buffer, alias);
+				spprintf(error, 0, "cannot load phar \"%s\" with implicit alias \"%.*s\" under different alias \"%s\"", fname, tmp_len, buffer, alias);
 			}
 
 			efree(savebuf);
-- 
2.1.4