Bug #75691 [NEW]: off by one overflow

From: YangX92 at hotmail dot com Operating system: Linux PHP version: 7.2Git-2017-12-15 (Git) Package: PHAR related Bug Type: Bug Bug description:off by one overflow Description: ------------ There is a off-by-one overflow in phar_is_tar function in ext/phar/tar.c. >>> char save[sizeof(header->checksum)], *bname; /* assume that the first filename in a tar won't begin with <?php */ if (!strncmp(buf, "<?php", sizeof("<?php")-1)) { return 0; } memcpy(save, header->checksum, sizeof(header->checksum)); memset(header->checksum, ' ', sizeof(header->checksum)); >>> As code show above, the length of save should be sizeof(header->checksum)+1. Because, the char array should be terminated by the NULL character. Test script: --------------- No Expected result: ---------------- No Actual result: -------------- No -- Edit bug report at https://bugs.php.net/bug.php?id=75691&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75691&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75691&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75691&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=75691&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=75691&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=75691&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=75691&r=needscript Try newer version: https://bugs.php.net/fix.php?id=75691&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=75691&r=support Expected behavior: https://bugs.php.net/fix.php?id=75691&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=75691&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=75691&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=75691&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75691&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=75691&r=dst IIS Stability: https://bugs.php.net/fix.php?id=75691&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=75691&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=75691&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=75691&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=75691&r=mysqlcfg