author | Rich Burridge <rich.burridge@oracle.com> |
Tue, 13 Oct 2015 18:21:51 -0700 | |
changeset 4945 | d9d54aa673b6 |
parent 4494 | f5b717124172 |
permissions | -rw-r--r-- |
4494
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
1 |
CVE-2015-2783 |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
2 |
Community BUG: |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
3 |
https://bugs.php.net/bug.php?id=69324 |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
4 |
Community CODE: |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
5 |
http://git.php.net/?p=php-src.git;a=commit;h=9faaee66fa493372c7340b1ab05f8fd115131a42 |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
6 |
Below is the community patch. |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
7 |
|
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
8 |
Not including the test files at the moment: |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
9 |
ext/phar/tests/bug69324.phar |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
10 |
ext/phar/tests/bug69324.phpt |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
11 |
because our version of gpatch doesn't understand the git binary data file. |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
12 |
|
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
13 |
|
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
14 |
|
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
15 |
From 9faaee66fa493372c7340b1ab05f8fd115131a42 Mon Sep 17 00:00:00 2001 |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
16 |
From: Stanislav Malyshev <[email protected]> |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
17 |
Date: Sun, 5 Apr 2015 15:07:36 -0700 |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
18 |
Subject: [PATCH] Fixed bug #69324 (Buffer Over-read in unserialize when |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
19 |
parsing Phar) |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
20 |
|
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
21 |
--- |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
22 |
ext/phar/phar.c | 65 ++++++++++++++++++++----------------------- |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
23 |
ext/phar/phar_internal.h | 2 +- |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
24 |
ext/phar/tests/bug69324.phar | Bin 0 -> 269 bytes |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
25 |
ext/phar/tests/bug69324.phpt | 17 +++++++++++ |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
26 |
4 files changed, 48 insertions(+), 36 deletions(-) |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
27 |
create mode 100644 ext/phar/tests/bug69324.phar |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
28 |
create mode 100644 ext/phar/tests/bug69324.phpt |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
29 |
|
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
30 |
diff --git a/ext/phar/phar.c b/ext/phar/phar.c |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
31 |
index ec82351..bf0c985 100644 |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
32 |
--- a/ext/phar/phar.c |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
33 |
+++ b/ext/phar/phar.c |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
34 |
@@ -603,25 +603,18 @@ int phar_open_parsed_phar(char *fname, int fname_len, char *alias, int alias_len |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
35 |
* |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
36 |
* data is the serialized zval |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
37 |
*/ |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
38 |
-int phar_parse_metadata(char **buffer, zval **metadata, int zip_metadata_len TSRMLS_DC) /* {{{ */ |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
39 |
+int phar_parse_metadata(char **buffer, zval **metadata, php_uint32 zip_metadata_len TSRMLS_DC) /* {{{ */ |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
40 |
{ |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
41 |
const unsigned char *p; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
42 |
- php_uint32 buf_len; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
43 |
php_unserialize_data_t var_hash; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
44 |
|
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
45 |
- if (!zip_metadata_len) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
46 |
- PHAR_GET_32(*buffer, buf_len); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
47 |
- } else { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
48 |
- buf_len = zip_metadata_len; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
49 |
- } |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
50 |
- |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
51 |
- if (buf_len) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
52 |
+ if (zip_metadata_len) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
53 |
ALLOC_ZVAL(*metadata); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
54 |
INIT_ZVAL(**metadata); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
55 |
p = (const unsigned char*) *buffer; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
56 |
PHP_VAR_UNSERIALIZE_INIT(var_hash); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
57 |
|
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
58 |
- if (!php_var_unserialize(metadata, &p, p + buf_len, &var_hash TSRMLS_CC)) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
59 |
+ if (!php_var_unserialize(metadata, &p, p + zip_metadata_len, &var_hash TSRMLS_CC)) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
60 |
PHP_VAR_UNSERIALIZE_DESTROY(var_hash); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
61 |
zval_ptr_dtor(metadata); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
62 |
*metadata = NULL; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
63 |
@@ -633,19 +626,14 @@ int phar_parse_metadata(char **buffer, zval **metadata, int zip_metadata_len TSR |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
64 |
if (PHAR_G(persist)) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
65 |
/* lazy init metadata */ |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
66 |
zval_ptr_dtor(metadata); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
67 |
- *metadata = (zval *) pemalloc(buf_len, 1); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
68 |
- memcpy(*metadata, *buffer, buf_len); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
69 |
- *buffer += buf_len; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
70 |
+ *metadata = (zval *) pemalloc(zip_metadata_len, 1); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
71 |
+ memcpy(*metadata, *buffer, zip_metadata_len); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
72 |
return SUCCESS; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
73 |
} |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
74 |
} else { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
75 |
*metadata = NULL; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
76 |
} |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
77 |
|
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
78 |
- if (!zip_metadata_len) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
79 |
- *buffer += buf_len; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
80 |
- } |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
81 |
- |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
82 |
return SUCCESS; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
83 |
} |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
84 |
/* }}}*/ |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
85 |
@@ -666,6 +654,7 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
86 |
phar_entry_info entry; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
87 |
php_uint32 manifest_len, manifest_count, manifest_flags, manifest_index, tmp_len, sig_flags; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
88 |
php_uint16 manifest_ver; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
89 |
+ php_uint32 len; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
90 |
long offset; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
91 |
int sig_len, register_alias = 0, temp_alias = 0; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
92 |
char *signature = NULL; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
93 |
@@ -1031,16 +1020,21 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
94 |
mydata->is_persistent = PHAR_G(persist); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
95 |
|
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
96 |
/* check whether we have meta data, zero check works regardless of byte order */ |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
97 |
+ PHAR_GET_32(buffer, len); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
98 |
if (mydata->is_persistent) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
99 |
- PHAR_GET_32(buffer, mydata->metadata_len); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
100 |
- if (phar_parse_metadata(&buffer, &mydata->metadata, mydata->metadata_len TSRMLS_CC) == FAILURE) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
101 |
- MAPPHAR_FAIL("unable to read phar metadata in .phar file \"%s\""); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
102 |
- } |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
103 |
- } else { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
104 |
- if (phar_parse_metadata(&buffer, &mydata->metadata, 0 TSRMLS_CC) == FAILURE) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
105 |
- MAPPHAR_FAIL("unable to read phar metadata in .phar file \"%s\""); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
106 |
+ mydata->metadata_len = len; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
107 |
+ if(!len) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
108 |
+ /* FIXME: not sure why this is needed but removing it breaks tests */ |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
109 |
+ PHAR_GET_32(buffer, len); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
110 |
} |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
111 |
} |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
112 |
+ if(len > endbuffer - buffer) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
113 |
+ MAPPHAR_FAIL("internal corruption of phar \"%s\" (trying to read past buffer end)"); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
114 |
+ } |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
115 |
+ if (phar_parse_metadata(&buffer, &mydata->metadata, len TSRMLS_CC) == FAILURE) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
116 |
+ MAPPHAR_FAIL("unable to read phar metadata in .phar file \"%s\""); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
117 |
+ } |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
118 |
+ buffer += len; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
119 |
|
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
120 |
/* set up our manifest */ |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
121 |
zend_hash_init(&mydata->manifest, manifest_count, |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
122 |
@@ -1075,7 +1069,7 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
123 |
entry.manifest_pos = manifest_index; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
124 |
} |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
125 |
|
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
126 |
- if (buffer + entry.filename_len + 20 > endbuffer) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
127 |
+ if (entry.filename_len + 20 > endbuffer - buffer) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
128 |
MAPPHAR_FAIL("internal corruption of phar \"%s\" (truncated manifest entry)"); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
129 |
} |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
130 |
|
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
131 |
@@ -1111,19 +1105,20 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
132 |
entry.flags |= PHAR_ENT_PERM_DEF_DIR; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
133 |
} |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
134 |
|
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
135 |
+ PHAR_GET_32(buffer, len); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
136 |
if (entry.is_persistent) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
137 |
- PHAR_GET_32(buffer, entry.metadata_len); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
138 |
- if (!entry.metadata_len) buffer -= 4; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
139 |
- if (phar_parse_metadata(&buffer, &entry.metadata, entry.metadata_len TSRMLS_CC) == FAILURE) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
140 |
- pefree(entry.filename, entry.is_persistent); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
141 |
- MAPPHAR_FAIL("unable to read file metadata in .phar file \"%s\""); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
142 |
- } |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
143 |
+ entry.metadata_len = len; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
144 |
} else { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
145 |
- if (phar_parse_metadata(&buffer, &entry.metadata, 0 TSRMLS_CC) == FAILURE) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
146 |
- pefree(entry.filename, entry.is_persistent); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
147 |
- MAPPHAR_FAIL("unable to read file metadata in .phar file \"%s\""); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
148 |
- } |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
149 |
+ entry.metadata_len = 0; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
150 |
+ } |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
151 |
+ if (len > endbuffer - buffer) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
152 |
+ MAPPHAR_FAIL("internal corruption of phar \"%s\" (truncated manifest entry)"); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
153 |
+ } |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
154 |
+ if (phar_parse_metadata(&buffer, &entry.metadata, len TSRMLS_CC) == FAILURE) { |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
155 |
+ pefree(entry.filename, entry.is_persistent); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
156 |
+ MAPPHAR_FAIL("unable to read file metadata in .phar file \"%s\""); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
157 |
} |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
158 |
+ buffer += len; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
159 |
|
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
160 |
entry.offset = entry.offset_abs = offset; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
161 |
offset += entry.compressed_filesize; |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
162 |
diff --git a/ext/phar/phar_internal.h b/ext/phar/phar_internal.h |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
163 |
index c9306c1..fcfc864 100644 |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
164 |
--- a/ext/phar/phar_internal.h |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
165 |
+++ b/ext/phar/phar_internal.h |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
166 |
@@ -654,7 +654,7 @@ int phar_mount_entry(phar_archive_data *phar, char *filename, int filename_len, |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
167 |
char *phar_find_in_include_path(char *file, int file_len, phar_archive_data **pphar TSRMLS_DC); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
168 |
char *phar_fix_filepath(char *path, int *new_len, int use_cwd TSRMLS_DC); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
169 |
phar_entry_info * phar_open_jit(phar_archive_data *phar, phar_entry_info *entry, char **error TSRMLS_DC); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
170 |
-int phar_parse_metadata(char **buffer, zval **metadata, int zip_metadata_len TSRMLS_DC); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
171 |
+int phar_parse_metadata(char **buffer, zval **metadata, php_uint32 zip_metadata_len TSRMLS_DC); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
172 |
void destroy_phar_manifest_entry(void *pDest); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
173 |
int phar_seek_efp(phar_entry_info *entry, off_t offset, int whence, off_t position, int follow_links TSRMLS_DC); |
f5b717124172
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
174 |
php_stream *phar_get_efp(phar_entry_info *entry, int follow_links TSRMLS_DC); |