php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.5'

Browse Source 
* PHP-8.5:
  Fix GH-20732: Phar::LoadPhar undefined behavior when loading directory
This commit is contained in:
Niels Dossche
2025-12-20 11:16:36 +01:00
parent cec087e02f 66d4441217
commit 3e87cfa9c8
2 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ext/phar/phar.c
View File

@@ -1571,7 +1571,7 @@ static zend_result phar_open_from_fp(php_stream* fp, char *fname, size_t fname_l
const zend_long readsize = sizeof(buffer) - sizeof(token);
const zend_long tokenlen = sizeof(token) - 1;
zend_long halt_offset;
size_t got;
ssize_t got;
uint32_t compression = PHAR_FILE_COMPRESSED_NONE;
if (error) {
@@ -1589,7 +1589,7 @@ static zend_result phar_open_from_fp(php_stream* fp, char *fname, size_t fname_l
/* Maybe it's better to compile the file instead of just searching, */
/* but we only want the offset. So we want a .re scanner to find it. */
while(!php_stream_eof(fp)) {
if ((got = php_stream_read(fp, buffer+tokenlen, readsize)) < (size_t) tokenlen) {
if ((got = php_stream_read(fp, buffer+tokenlen, readsize)) < tokenlen) {
MAPPHAR_ALLOC_FAIL("internal corruption of phar \"%s\" (truncated entry)")
}

14
ext/phar/tests/gh20732.phpt Normal file
View File

@@ -0,0 +1,14 @@
--TEST--
GH-20732 (Phar::LoadPhar undefined behavior when loading directory)
--EXTENSIONS--
phar
--FILE--
<?php
try {
@Phar::LoadPhar('.');
} catch (PharException $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECTF--
%r(internal corruption of phar "%s" \(truncated entry\)|unable to open phar for reading ".")%r