[php-src] PR #23442: Fix GH-23418: UAF when accessing mounted Phar subdirectories
| From: | LamentXU123 | Date: | Tue, 25 Aug 2026 06:00:54 +0000 |
| Subject: | [php-src] PR #23442: Fix GH-23418: UAF when accessing mounted Phar subdirectories | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38119@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23442
Author: LamentXU123
The UAF is basically because we trick the
phar_mount_entry to fail and the code goes to
```c
if (SUCCESS != phar_mount_entry(phar, test, test_len, path, path_len)) {
efree(test);
if (error) {
spprintf(error, 4096, "phar error: path \"%s\" exists as file \"%s\"
and could not be mounted", path, test);
}
```
Self-evidence buggy code I'd say... we freed test and use it in spprintf. Haha.
Here we passes a properly null-terminated copy of the shortened path to
phar_mount_entry() instead and keep test alive until error formatting and
manifest lookup have completed.