Bug #77565 [NEW]: Incorrect locator detection in ZIP-based phars

From: tshumbeo at mailhouse dot biz Operating system: Any PHP version: 7.3.1 Package: PHAR related Bug Type: Bug Bug description:Incorrect locator detection in ZIP-based phars Description: ------------ phar_parse_zipfile() is looking for the end of central directory (phar_zip_dir_end locator) by going from the file's beginning to the end, stopping at the first occurrence. Due to this, it may locate a sequence that looks like EOCD but is not one. Instead, it should go from the end of the file or, at very least, postpone decision about the locator until the entire stream is traversed, and use the last occurrence (which is in accordance with the spec). As of now, Phar is unable to open a ZIP archive that contains another ZIP archive inside, or a similarly looking file, and is not deflated. Test script: --------------- # mkdir test # cd test # touch file # zip 1.zip file adding: file (stored 0%) # zip 2.zip 1.zip adding: 1.zip (stored 0%) # php -r 'new PharData("1.zip"); echo "ok";' ok # php -r 'new PharData("2.zip");' PHP Fatal error: Uncaught UnexpectedValueException: phar error: corrupted central directory entry, no magic signature in zip-based phar "/tmp/test/2.zip" in Command line code:1 -- Edit bug report at https://bugs.php.net/bug.php?id=77565&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=77565&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=77565&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=77565&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=77565&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=77565&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=77565&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=77565&r=needscript Try newer version: https://bugs.php.net/fix.php?id=77565&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=77565&r=support Expected behavior: https://bugs.php.net/fix.php?id=77565&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=77565&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=77565&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=77565&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=77565&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=77565&r=dst IIS Stability: https://bugs.php.net/fix.php?id=77565&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=77565&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=77565&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=77565&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=77565&r=mysqlcfg