You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 

71 lines
2.1 KiB

From a6fdc5bb27b20d889de0cd29318b3968aabb57bd Mon Sep 17 00:00:00 2001
From: Roberto C. Sanchez <roberto@debian.org>
Date: Thu, 26 Jan 2017 23:00:20 -0500
Subject: [PATCH] CVE-2016-3142
Fix bug #71498: Out-of-Bound Read in phar_parse_zipfile()
[roberto@debian.org: backported to 5.4.45]
Bug: https://bugs.php.net/bug.php?id=71498
Origin: backport, https://git.php.net/?p=php-src.git;a=commit;h=a6fdc5bb27b20d889de0cd29318b3968aabb57bd
--- php5.git.orig/ext/phar/tests/bug71488.phpt
+++ php5.git/ext/phar/tests/bug71488.phpt
@@ -7,6 +7,7 @@
$p = new PharData(__DIR__."/bug71488.tar");
$newp = $p->decompress("test");
?>
+
DONE
--CLEAN--
<?php
--- /dev/null
+++ php5.git/ext/phar/tests/bug71498.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Phar: bug #71498: Out-of-Bound Read in phar_parse_zipfile()
+--SKIPIF--
+<?php if (!extension_loaded("phar")) die("skip"); ?>
+--FILE--
+<?php
+try {
+$p = new PharData(__DIR__."/bug71498.zip");
+} catch(UnexpectedValueException $e) {
+ echo $e->getMessage();
+}
+?>
+
+DONE
+--EXPECTF--
+phar error: end of central directory not found in zip-based phar "%s/bug71498.zip"
+DONE
\ No newline at end of file
--- php5.git.orig/ext/phar/zip.c
+++ php5.git/ext/phar/zip.c
@@ -159,7 +159,7 @@
*
* Parse a new one and add it to the cache, returning either SUCCESS or
* FAILURE, and setting pphar to the pointer to the manifest entry
- *
+ *
* This is used by phar_open_from_fp to process a zip-based phar, but can be called
* directly.
*/
@@ -199,7 +199,7 @@
}
while ((p=(char *) memchr(p + 1, 'P', (size_t) (size - (p + 1 - buf)))) != NULL) {
- if (!memcmp(p + 1, "K\5\6", 3)) {
+ if ((p - buf) + sizeof(locator) <= size && !memcmp(p + 1, "K\5\6", 3)) {
memcpy((void *)&locator, (void *) p, sizeof(locator));
if (PHAR_GET_16(locator.centraldisk) != 0 || PHAR_GET_16(locator.disknumber) != 0) {
/* split archives not handled */
@@ -1171,7 +1171,7 @@
static const char newstub[] = "<?php // zip-based phar archive stub file\n__HALT_COMPILER();";
char halt_stub[] = "__HALT_COMPILER();";
char *tmp;
-
+
php_stream *stubfile, *oldfile;
php_serialize_data_t metadata_hash;
int free_user_stub, closeoldfile = 0;