Bug #73763 [NEW]: phar header miscalculation

From: eyal dot itkin at gmail dot com Operating system: PHP version: 7.1.0 Package: PHAR related Bug Type: Bug Bug description:phar header miscalculation Description: ------------ phar_parse_pharfile() uses incorrect manifest header size of 10 bytes instead of 14 bytes. This leads to several incorrect checks: 1) The constant should be 14 bytes, instead of 10: if (manifest_len < 10 || manifest_len != php_stream_read(fp, buffer, manifest_len)) { This means that later the alias length (tmp_len) is read without being checked to be present in the buffer. 2) The alias length checks should be updated: if (buffer + tmp_len > endbuffer) { MAPPHAR_FAIL("internal corruption of phar \"%s\" (buffer overrun)"); } if (manifest_len < 10 + tmp_len) { MAPPHAR_FAIL("internal corruption of phar \"%s\" (truncated manifest header)") } 1st check is vulnerable to integer-overflow, and the 2nd uses incorrect size and is redundant. Fix should be: if (tmp_len > endbuffer - buffer) { MAPPHAR_FAIL("internal corruption of phar \"%s\" (buffer overrun)"); } -- Edit bug report at https://bugs.php.net/bug.php?id=73763&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73763&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73763&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73763&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=73763&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=73763&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=73763&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=73763&r=needscript Try newer version: https://bugs.php.net/fix.php?id=73763&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=73763&r=support Expected behavior: https://bugs.php.net/fix.php?id=73763&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=73763&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=73763&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=73763&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73763&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=73763&r=dst IIS Stability: https://bugs.php.net/fix.php?id=73763&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=73763&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=73763&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=73763&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=73763&r=mysqlcfg