My Alpine packages repository.
https://dryabzhinsky.noip.me/packages/en/alpinelinux-support/
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
71 lines
2.1 KiB
71 lines
2.1 KiB
From a6fdc5bb27b20d889de0cd29318b3968aabb57bd Mon Sep 17 00:00:00 2001 |
|
From: Roberto C. Sanchez <roberto@debian.org> |
|
Date: Thu, 26 Jan 2017 23:00:20 -0500 |
|
Subject: [PATCH] CVE-2016-3142 |
|
|
|
Fix bug #71498: Out-of-Bound Read in phar_parse_zipfile() |
|
|
|
[roberto@debian.org: backported to 5.4.45] |
|
|
|
Bug: https://bugs.php.net/bug.php?id=71498 |
|
Origin: backport, https://git.php.net/?p=php-src.git;a=commit;h=a6fdc5bb27b20d889de0cd29318b3968aabb57bd |
|
--- php5.git.orig/ext/phar/tests/bug71488.phpt |
|
+++ php5.git/ext/phar/tests/bug71488.phpt |
|
@@ -7,6 +7,7 @@ |
|
$p = new PharData(__DIR__."/bug71488.tar"); |
|
$newp = $p->decompress("test"); |
|
?> |
|
+ |
|
DONE |
|
--CLEAN-- |
|
<?php |
|
--- /dev/null |
|
+++ php5.git/ext/phar/tests/bug71498.phpt |
|
@@ -0,0 +1,17 @@ |
|
+--TEST-- |
|
+Phar: bug #71498: Out-of-Bound Read in phar_parse_zipfile() |
|
+--SKIPIF-- |
|
+<?php if (!extension_loaded("phar")) die("skip"); ?> |
|
+--FILE-- |
|
+<?php |
|
+try { |
|
+$p = new PharData(__DIR__."/bug71498.zip"); |
|
+} catch(UnexpectedValueException $e) { |
|
+ echo $e->getMessage(); |
|
+} |
|
+?> |
|
+ |
|
+DONE |
|
+--EXPECTF-- |
|
+phar error: end of central directory not found in zip-based phar "%s/bug71498.zip" |
|
+DONE |
|
\ No newline at end of file |
|
--- php5.git.orig/ext/phar/zip.c |
|
+++ php5.git/ext/phar/zip.c |
|
@@ -159,7 +159,7 @@ |
|
* |
|
* Parse a new one and add it to the cache, returning either SUCCESS or |
|
* FAILURE, and setting pphar to the pointer to the manifest entry |
|
- * |
|
+ * |
|
* This is used by phar_open_from_fp to process a zip-based phar, but can be called |
|
* directly. |
|
*/ |
|
@@ -199,7 +199,7 @@ |
|
} |
|
|
|
while ((p=(char *) memchr(p + 1, 'P', (size_t) (size - (p + 1 - buf)))) != NULL) { |
|
- if (!memcmp(p + 1, "K\5\6", 3)) { |
|
+ if ((p - buf) + sizeof(locator) <= size && !memcmp(p + 1, "K\5\6", 3)) { |
|
memcpy((void *)&locator, (void *) p, sizeof(locator)); |
|
if (PHAR_GET_16(locator.centraldisk) != 0 || PHAR_GET_16(locator.disknumber) != 0) { |
|
/* split archives not handled */ |
|
@@ -1171,7 +1171,7 @@ |
|
static const char newstub[] = "<?php // zip-based phar archive stub file\n__HALT_COMPILER();"; |
|
char halt_stub[] = "__HALT_COMPILER();"; |
|
char *tmp; |
|
- |
|
+ |
|
php_stream *stubfile, *oldfile; |
|
php_serialize_data_t metadata_hash; |
|
int free_user_stub, closeoldfile = 0;
|
|
|