1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
|
From a10e778bfb7ce9caa1f91666ddf2705db7982d68 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Tue, 15 May 2012 22:34:34 -0700
Subject: [PATCH] fix bug #61065
---
ext/phar/tar.c | 10 ++++++++++
1 files changed, 10 insertions(+), 0 deletions(-)
diff --git a/ext/phar/tar.c b/ext/phar/tar.c
index 9d1e5bc..b914db1 100644
--- a/ext/phar/tar.c
+++ b/ext/phar/tar.c
@@ -337,6 +337,16 @@ bail:
last_was_longlink = 1;
/* support the ././@LongLink system for storing long filenames */
entry.filename_len = entry.uncompressed_filesize;
+
+ /* Check for overflow - bug 61065 */
+ if (entry.filename_len == UINT_MAX) {
+ if (error) {
+ spprintf(error, 4096, "phar error: \"%s\" is a corrupted tar file (invalid entry size)", fname);
+ }
+ php_stream_close(fp);
+ phar_destroy_phar_data(myphar TSRMLS_CC);
+ return FAILURE;
+ }
entry.filename = pemalloc(entry.filename_len+1, myphar->is_persistent);
read = php_stream_read(fp, entry.filename, entry.filename_len);
--
1.7.8
|
