php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4'

Browse Source 
* PHP-8.4:
  Fix GH-17518: offset overflow phar extractTo()
This commit is contained in:
Niels Dossche
2025-01-19 13:06:01 +01:00
parent 675f359e91 7cc8719ee5
commit b8ee4c2b19
2 changed files with 24 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ext/phar/phar_object.c
View File

@@ -4327,7 +4327,7 @@ static int extract_helper(phar_archive_data *archive, zend_string *search, char
if (FAILURE == phar_extract_file(overwrite, entry, pathto, pathto_len, error)) return -1;
extracted++;
} ZEND_HASH_FOREACH_END();
} else if ('/' == ZSTR_VAL(search)[ZSTR_LEN(search) - 1]) {
} else if (ZSTR_LEN(search) > 0 && '/' == ZSTR_VAL(search)[ZSTR_LEN(search) - 1]) {
/* ends in "/" -- extract all entries having that prefix */
ZEND_HASH_MAP_FOREACH_PTR(&archive->manifest, entry) {
if (!zend_string_starts_with(entry->filename, search)) continue;

23
ext/phar/tests/gh17518.phpt Normal file
View File

@@ -0,0 +1,23 @@
--TEST--
GH-17518 (offset overflow phar extractTo())
--EXTENSIONS--
phar
--INI--
phar.readonly=0
--FILE--
<?php
$fname = __DIR__.'/gh17518.phar.php';
$phar = new Phar($fname);
$phar['a'] = 'b';
try {
$phar->extractTo(__DIR__ . '/gh17518', '');
} catch (Throwable $e) {
echo $e::class, ": ", $e->getMessage(), "\n";
}
?>
--CLEAN--
<?php
@unlink(__DIR__.'/gh17518.phar.php');
?>
--EXPECTF--
PharException: phar error: attempted to extract non-existent file or directory "" from phar "%sgh17518.phar.php"