Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings
forked fromphp/php-src

Commitcd1101e

Browse files
cmb69smalyshev
authored andcommitted
Fix #77919: Potential UAF in Phar RSHUTDOWN
We have to properly clean up in case phar_flush() is failing.We also make the expectation of the respective test case less liberalto avoid missing such bugs in the future.
1 parent42e8b85 commitcd1101e

File tree

3 files changed

+10
-2
lines changed

3 files changed

+10
-2
lines changed

‎NEWS‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ PHP NEWS
1010
(CVE-2019-11042) (Stas)
1111
. Fixed bug #78222 (heap-buffer-overflow on exif_scan_thumbnail).
1212
(CVE-2019-11041) (Stas)
13+
14+
- Phar:
15+
. Fixed bug #77919 (Potential UAF in Phar RSHUTDOWN). (cmb)
1316

1417
30 May 2019, PHP 7.1.30
1518

‎ext/phar/phar_object.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2037,7 +2037,7 @@ static zend_object *phar_rename_archive(phar_archive_data **sphar, char *ext, ze
20372037
char*newname=NULL,*newpath=NULL;
20382038
zvalret,arg1;
20392039
zend_class_entry*ce;
2040-
char*error;
2040+
char*error=NULL;
20412041
constchar*pcr_error;
20422042
intext_len=ext ?strlen(ext) :0;
20432043
size_tnew_len,oldname_len;
@@ -2205,6 +2205,8 @@ static zend_object *phar_rename_archive(phar_archive_data **sphar, char *ext, ze
22052205
phar_flush(phar,0,0,1,&error);
22062206

22072207
if (error) {
2208+
zend_hash_str_del(&(PHAR_G(phar_fname_map)),newpath,phar->fname_len);
2209+
*sphar=NULL;
22082210
zend_throw_exception_ex(spl_ce_BadMethodCallException,0,"%s",error);
22092211
efree(error);
22102212
efree(oldpath);

‎ext/phar/tests/bug71488.phpt‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,7 @@ DONE
1515
?>
1616
--EXPECTF--
1717
Fatal error: Uncaught BadMethodCallException: tar-based phar "%s/bug71488.test" cannot be created, link "%s" is too long for format in %sbug71488.php:%d
18-
Stack trace:%A
18+
Stack trace:
19+
#0 %s(%d): PharData->decompress('test')
20+
#1 {main}
21+
thrown in %s on line %d

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp