Skip to content

Commit

Permalink
Fix #77322: PharData::addEmptyDir('/') Possible integer overflow
Browse files Browse the repository at this point in the history
`phar_path_check()` already strips a leading slash, so we must not
attempt to strip the trailing slash from an now empty directory name.

Closes GH-6508.
  • Loading branch information
cmb69 committed Dec 15, 2020
1 parent c0a1c2c commit a53d67c
Show file tree
Hide file tree
Showing 3 changed files with 28 additions and 2 deletions.
4 changes: 3 additions & 1 deletion NEWS
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,9 @@ PHP NEWS

- Phar:
. Fixed bug #73809 (Phar Zip parse crash - mmap fail). (cmb)
. Fixed #75102 (`PharData` says invalid checksum for valid tar). (cmb)
. Fixed bug #75102 (`PharData` says invalid checksum for valid tar). (cmb)
. Fixed bug #77322 (PharData::addEmptyDir('/') Possible integer overflow).
(cmb)

- PDO MySQL:
. Fixed bug #80458 (PDOStatement::fetchAll() throws for upsert queries).
Expand Down
24 changes: 24 additions & 0 deletions ext/phar/tests/bug77322.phpt
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
--TEST--
Bug #77322 (PharData::addEmptyDir('/') Possible integer overflow)
--SKIPIF--
<?php
if (!extension_loaded('phar')) die('skip phar extension not available');
?>
--FILE--
<?php
$zip = new PharData(__DIR__ . '/bug77322.zip');
$zip->addEmptyDir('/');
var_dump($zip->count());

$tar = new PharData(__DIR__ . '/bug77322.tar');
$tar->addEmptyDir('/');
var_dump($tar->count());
?>
--EXPECT--
int(1)
int(1)
--CLEAN--
<?php
unlink(__DIR__ . '/bug77322.zip');
unlink(__DIR__ . '/bug77322.tar');
?>
2 changes: 1 addition & 1 deletion ext/phar/util.c
Original file line number Diff line number Diff line change
Expand Up @@ -567,7 +567,7 @@ phar_entry_data *phar_get_or_create_entry_data(char *fname, size_t fname_len, ch
} else {
etemp.flags = etemp.old_flags = PHAR_ENT_PERM_DEF_FILE;
}
if (is_dir) {
if (is_dir && path_len) {
etemp.filename_len--; /* strip trailing / */
path_len--;
}
Expand Down

0 comments on commit a53d67c

Please sign in to comment.