Reject oversized metadata entries before allocating their contents so
malformed archives fail without exhausting the memory limit.
Fixes GH-24740
Closes GH-24742
In the CGI/FastCGI branch of webPhar(), when SCRIPT_NAME is present but
PATH_INFO is absent, path_info was aliased to the testit buffer and
free_pathinfo was set. Since commit 3ee2f442d2 added an unconditional
efree(testit) after that branch, path_info became a dangling pointer.
This causes a use-after-free when path_info is read later and a
double-free at cleanup_skip_entry when free_pathinfo triggers
efree(path_info).
The regression was introduced in PHP 8.6. Earlier release branches do
not free testit at this point.
Allocate a dedicated copy for path_info so its lifetime outlives the
efree(testit).
Reported by RigelYoung.
Closes#24166
* PHP-8.5:
Skip bz2 GH-20807 test when less than 13 GiB of memory is available
ext/soap: make GHSA-cj93-vc83-wgqv test lean and reliable
Add NEWS entries
ext/standard: Fix 1-char relative Location redirects after GH-23467
[http] Fix out-of-bounds read on empty Location header
Fix GHSA-ch8v-r6jh-4vvr: encode 0xFF in FILTER_SANITIZE_ENCODED
Fix GHSA-9f67-6fw4-hpfp
Fix GHSA-j3wh-g957-2m85: phar tar entry injection
Fix GHSA-cj93-vc83-wgqv
Fix GHSA-rgrp-mwpx-f6rm: unbounded recursion in ext/soap XML parsing and decoding
Fix GHSA-fpwc-w8rq-cr92: strip credentials from user headers on cross-origin redirects
Fix GHSA-r6x9-5r99-36j7: Various packet overreads in mysqlnd wireprotocol
Fix GHSA-xr7j-rvgx-xq5p: OOB read in php_openssl_matches_wildcard_name()
Fix GHSA-vvx9-73fr-5jjx: do not fall back to CN if the cert has a service ID
Fix GHSA-62xp-839h-2637: FastCGI allowed_clients compared only 96 bits of IPv6 addresses
Fix heap-buffer-overflow in convert stream filters with NUL in line-break-chars
# Conflicts:
# NEWS
# ext/openssl/xp_ssl.c
# ext/phar/tar.c
# ext/soap/php_http.c
# ext/standard/http_fopen_wrapper.c
* PHP-8.4:
Skip bz2 GH-20807 test when less than 13 GiB of memory is available
ext/soap: make GHSA-cj93-vc83-wgqv test lean and reliable
Add NEWS entries
ext/standard: Fix 1-char relative Location redirects after GH-23467
[http] Fix out-of-bounds read on empty Location header
Fix GHSA-ch8v-r6jh-4vvr: encode 0xFF in FILTER_SANITIZE_ENCODED
Fix GHSA-9f67-6fw4-hpfp
Fix GHSA-j3wh-g957-2m85: phar tar entry injection
Fix GHSA-cj93-vc83-wgqv
Fix GHSA-rgrp-mwpx-f6rm: unbounded recursion in ext/soap XML parsing and decoding
Fix GHSA-fpwc-w8rq-cr92: strip credentials from user headers on cross-origin redirects
Fix GHSA-r6x9-5r99-36j7: Various packet overreads in mysqlnd wireprotocol
Fix GHSA-xr7j-rvgx-xq5p: OOB read in php_openssl_matches_wildcard_name()
Fix GHSA-vvx9-73fr-5jjx: do not fall back to CN if the cert has a service ID
Fix GHSA-62xp-839h-2637: FastCGI allowed_clients compared only 96 bits of IPv6 addresses
Fix heap-buffer-overflow in convert stream filters with NUL in line-break-chars
# Conflicts:
# NEWS
# ext/phar/tar.c
# ext/soap/php_http.c
# ext/soap/php_xml.c
# ext/standard/http_fopen_wrapper.c
# win32/ioutil.c
* PHP-8.3:
ext/soap: make GHSA-cj93-vc83-wgqv test lean and reliable
Add NEWS entries
ext/standard: Fix 1-char relative Location redirects after GH-23467
[http] Fix out-of-bounds read on empty Location header
Fix GHSA-ch8v-r6jh-4vvr: encode 0xFF in FILTER_SANITIZE_ENCODED
Fix GHSA-9f67-6fw4-hpfp
Fix GHSA-j3wh-g957-2m85: phar tar entry injection
Fix GHSA-cj93-vc83-wgqv
Fix GHSA-rgrp-mwpx-f6rm: unbounded recursion in ext/soap XML parsing and decoding
Fix GHSA-fpwc-w8rq-cr92: strip credentials from user headers on cross-origin redirects
Fix GHSA-r6x9-5r99-36j7: Various packet overreads in mysqlnd wireprotocol
Fix GHSA-xr7j-rvgx-xq5p: OOB read in php_openssl_matches_wildcard_name()
Fix GHSA-vvx9-73fr-5jjx: do not fall back to CN if the cert has a service ID
Fix GHSA-62xp-839h-2637: FastCGI allowed_clients compared only 96 bits of IPv6 addresses
Fix heap-buffer-overflow in convert stream filters with NUL in line-break-chars
# Conflicts:
# ext/openssl/xp_ssl.c
* PHP-8.2:
ext/soap: make GHSA-cj93-vc83-wgqv test lean and reliable
Add NEWS entries
ext/standard: Fix 1-char relative Location redirects after GH-23467
[http] Fix out-of-bounds read on empty Location header
Fix GHSA-ch8v-r6jh-4vvr: encode 0xFF in FILTER_SANITIZE_ENCODED
Fix GHSA-9f67-6fw4-hpfp
Fix GHSA-j3wh-g957-2m85: phar tar entry injection
Fix GHSA-cj93-vc83-wgqv
Fix GHSA-rgrp-mwpx-f6rm: unbounded recursion in ext/soap XML parsing and decoding
Fix GHSA-fpwc-w8rq-cr92: strip credentials from user headers on cross-origin redirects
Fix GHSA-r6x9-5r99-36j7: Various packet overreads in mysqlnd wireprotocol
Fix GHSA-xr7j-rvgx-xq5p: OOB read in php_openssl_matches_wildcard_name()
Fix GHSA-vvx9-73fr-5jjx: do not fall back to CN if the cert has a service ID
Fix GHSA-62xp-839h-2637: FastCGI allowed_clients compared only 96 bits of IPv6 addresses
Fix heap-buffer-overflow in convert stream filters with NUL in line-break-chars
Reject entry sizes that cannot be parsed or represented, and skip the data
blocks of every entry type that carries data. Both left the stream on
attacker controlled data that was then parsed as a tar header.
Here we passes a properly null-terminated copy of the shortened path
to `phar_mount_entry()` instead and keep `test` alive until error
formatting and manifest lookup have completed.
Splitting the behavioural change of #23052 out into this and come up with something that is hopefully more sensible and consistent between fast and slow ZPP and the object or class_name Fast ZPP specifier.
Fixed Phar archives being automatically detected when ".phar" only occurs
in a directory name or is not a filename extension in an included file's path.
This commit hardens tests in the phar and intl extension. By:
- Testing exception type in error tests, and formating them consistently.
- Removing useless blank lines
* main: move php_win32_docref{1|2}_from_error() functions and make static
Those are only used by the plain wrapper, so no need to expose them
* main: convert win32_docref functions to a new fonction using new stream error API
Replace `zend_hash_exists()` + `zend_hash_find_ptr()` with a single
`zend_hash_find_ptr()` call and a `NULL` check, avoiding an unnecessary
HashTable lookup.
Use a shared helper for checking whether a path refers to the magic .phar
directory. Treat .phar itself and paths below it as magic, while allowing
non-magic entries that merely use a .phar-prefixed name such as .pharx.
Apply the same check across creation, copying, ArrayAccess, stream lookup,
directory iteration, extraction, and mounts so these paths are handled
consistently.
Co-authored-by: Gina Peter Banyard <girgias@php.net>
Closes#22372
Ilia Alshanetsky