1 CVE-2015-2301

     2 Community BUG:

     3 https://bugs.php.net/bug.php?id=68901

     4 Community CODE:

     5 http://git.php.net/?p=php-src.git;a=commit;h=b2cf3f064b8f5efef89bb084521b61318c71781b

     6 Below is the community patch.

     7 

     8 

     9 diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c

    10 index 3671054..712795b 100644

    11 --- a/ext/phar/phar_object.c

    12 +++ b/ext/phar/phar_object.c

    13 @@ -2139,8 +2139,8 @@ static zval *phar_rename_archive(phar_archive_data *phar, char *ext, zend_bool c

    14  	}

    15  its_ok:

    16  	if (SUCCESS == php_stream_stat_path(newpath, &ssb)) {

    17 -		efree(oldpath);

    18  		zend_throw_exception_ex(spl_ce_BadMethodCallException, 0 TSRMLS_CC, "phar \"%s\" exists and must be unlinked prior to conversion", newpath);

    19 +		efree(oldpath);

    20  		return NULL;

    21  	}

    22  	if (!phar->is_data) {