[php-src] PR #25099: Fix GH-25089: Heap buffer over-read via crafted alias size in zip-based phar
| From: | lazerg | Date: | Sat, 31 Oct 2026 17:22:58 +0000 |
| Subject: | [php-src] PR #25099: Fix GH-25089: Heap buffer over-read via crafted alias size in zip-based phar | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40147@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25099
Author: lazerg
phar_parse_zipfile() set the alias length from the size claimed in the zip headers
before reading the alias, but the buffer only holds what was actually decompressed. A smaller
payload made phar_validate_alias() and Phar::getAlias() read past the
buffer, so the length is now taken after the read.
Fixes #25089