Skip to content

Commit b8ee4c2

Browse files
committed
Merge branch 'PHP-8.4'
* PHP-8.4: Fix GH-17518: offset overflow phar extractTo()
2 parents 675f359 + 7cc8719 commit b8ee4c2

File tree

2 files changed

+24
-1
lines changed

2 files changed

+24
-1
lines changed

ext/phar/phar_object.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -4327,7 +4327,7 @@ static int extract_helper(phar_archive_data *archive, zend_string *search, char
43274327
if (FAILURE == phar_extract_file(overwrite, entry, pathto, pathto_len, error)) return -1;
43284328
extracted++;
43294329
} ZEND_HASH_FOREACH_END();
4330-
} else if ('/' == ZSTR_VAL(search)[ZSTR_LEN(search) - 1]) {
4330+
} else if (ZSTR_LEN(search) > 0 && '/' == ZSTR_VAL(search)[ZSTR_LEN(search) - 1]) {
43314331
/* ends in "/" -- extract all entries having that prefix */
43324332
ZEND_HASH_MAP_FOREACH_PTR(&archive->manifest, entry) {
43334333
if (!zend_string_starts_with(entry->filename, search)) continue;

ext/phar/tests/gh17518.phpt

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
--TEST--
2+
GH-17518 (offset overflow phar extractTo())
3+
--EXTENSIONS--
4+
phar
5+
--INI--
6+
phar.readonly=0
7+
--FILE--
8+
<?php
9+
$fname = __DIR__.'/gh17518.phar.php';
10+
$phar = new Phar($fname);
11+
$phar['a'] = 'b';
12+
try {
13+
$phar->extractTo(__DIR__ . '/gh17518', '');
14+
} catch (Throwable $e) {
15+
echo $e::class, ": ", $e->getMessage(), "\n";
16+
}
17+
?>
18+
--CLEAN--
19+
<?php
20+
@unlink(__DIR__.'/gh17518.phar.php');
21+
?>
22+
--EXPECTF--
23+
PharException: phar error: attempted to extract non-existent file or directory "" from phar "%sgh17518.phar.php"

0 commit comments

Comments
 (0)