[php-src] PR #25197: Reject phar entries and archives beyond the 32-bit format limits
| From: | lazerg | Date: | Thu, 05 Nov 2026 01:09:55 +0000 |
| Subject: | [php-src] PR #25197: Reject phar entries and archives beyond the 32-bit format limits | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40307@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25197
Author: lazerg
Follow-up to #25054, split out so the PHP-8.4 fix stays small. Phar keeps sizes and offsets in
32-bit fields, and a few writers narrowed larger values without a check:
-
Phar::mount() stored a file of 4 GiB or more with a truncated size, so reads returned
only the low 32 bits worth of data.
- The tar writer accepted entries the tar reader rejects (sizes above UINT32_MAX - 511,
since GHSA-j3wh-g957-2m85), so the archive could not be opened again.
- The zip writer cast the central directory offset and size to 32 bits. Without zip64, an archive
past 4 GiB was written with a wrapped offset and reported as corrupted on reopen.
- Compressing an entry whose compressed size passes 4 GiB stored the narrowed size, in both phar and
zip.
These now fail (mount fails, flush throws a PharException) instead of writing an
archive that can't be read back. The tests need 4 GiB temp files, so they only run with
RUN_RESOURCE_HEAVY_TESTS.
Refs #25053