fix Bug #13110: using rewrite parameter to webPhar causes memory error

diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
index 2ef163b9654c4fcb20c58d5a1fc315fb3008b3e8..38ea938c84a4dcb3067b9cb8f7b2bcde6b76ffaa 100755 (executable)
--- a/ext/phar/phar_object.c
+++ b/ext/phar/phar_object.c
@@ -92,13 +92,15 @@ static void phar_mung_server_vars(char *fname, char *entry, int entry_len, char
                zval *temp; 
                char newname[] = "PHAR_PATH_INFO";
 
-               path_info = Z_STRVAL_PP(stuff); 
-               code = Z_STRLEN_PP(stuff); 
-               ZVAL_STRINGL(*stuff, Z_STRVAL_PP(stuff) + entry_len, Z_STRLEN_PP(stuff) - entry_len - request_uri_len, 1);
+               path_info = Z_STRVAL_PP(stuff);
+               code = Z_STRLEN_PP(stuff);
+               if (Z_STRLEN_PP(stuff) > entry_len && !memcmp(Z_STRVAL_PP(stuff), entry, entry_len)) {
+                       ZVAL_STRINGL(*stuff, Z_STRVAL_PP(stuff) + entry_len, Z_STRLEN_PP(stuff) - entry_len - request_uri_len, 1);
 
-               MAKE_STD_ZVAL(temp); 
-               ZVAL_STRINGL(temp, path_info, code, 0);
-               zend_hash_update(Z_ARRVAL_PP(_SERVER), newname, sizeof(newname), (void *) &temp, sizeof(zval **), NULL); 
+                       MAKE_STD_ZVAL(temp); 
+                       ZVAL_STRINGL(temp, path_info, code, 0);
+                       zend_hash_update(Z_ARRVAL_PP(_SERVER), newname, sizeof(newname), (void *) &temp, sizeof(zval **), NULL);
+               }
        }
        if (SUCCESS == zend_hash_find(Z_ARRVAL_PP(_SERVER), "PATH_TRANSLATED", sizeof("PATH_TRANSLATED"), (void **) &stuff)) { 
                int code; 
@@ -124,11 +126,13 @@ static void phar_mung_server_vars(char *fname, char *entry, int entry_len, char
 
                        path_info = Z_STRVAL_PP(stuff);
                        code = Z_STRLEN_PP(stuff);
-                       ZVAL_STRINGL(*stuff, Z_STRVAL_PP(stuff) + basename_len, Z_STRLEN_PP(stuff) - basename_len, 1);
+                       if (Z_STRLEN_PP(stuff) > basename_len && !memcmp(Z_STRVAL_PP(stuff), basename, basename_len)) {
+                               ZVAL_STRINGL(*stuff, Z_STRVAL_PP(stuff) + basename_len, Z_STRLEN_PP(stuff) - basename_len, 1);
 
-                       MAKE_STD_ZVAL(temp);
-                       ZVAL_STRINGL(temp, path_info, code, 0);
-                       zend_hash_update(Z_ARRVAL_PP(_SERVER), newname, sizeof(newname), (void *) &temp, sizeof(zval **), NULL);
+                               MAKE_STD_ZVAL(temp);
+                               ZVAL_STRINGL(temp, path_info, code, 0);
+                               zend_hash_update(Z_ARRVAL_PP(_SERVER), newname, sizeof(newname), (void *) &temp, sizeof(zval **), NULL);
+                       }
                }
        }
        if (zend_hash_exists(&(PHAR_GLOBALS->phar_SERVER_mung_list), "PHP_SELF", sizeof("PHP_SELF")-1)) {
@@ -139,11 +143,13 @@ static void phar_mung_server_vars(char *fname, char *entry, int entry_len, char
 
                        path_info = Z_STRVAL_PP(stuff);
                        code = Z_STRLEN_PP(stuff);
-                       ZVAL_STRINGL(*stuff, Z_STRVAL_PP(stuff) + basename_len, Z_STRLEN_PP(stuff) - basename_len, 1);
+                       if (Z_STRLEN_PP(stuff) > basename_len && !memcmp(Z_STRVAL_PP(stuff), basename, basename_len)) {
+                               ZVAL_STRINGL(*stuff, Z_STRVAL_PP(stuff) + basename_len, Z_STRLEN_PP(stuff) - basename_len, 1);
 
-                       MAKE_STD_ZVAL(temp);
-                       ZVAL_STRINGL(temp, path_info, code, 0);
-                       zend_hash_update(Z_ARRVAL_PP(_SERVER), newname, sizeof(newname), (void *) &temp, sizeof(zval **), NULL);
+                               MAKE_STD_ZVAL(temp);
+                               ZVAL_STRINGL(temp, path_info, code, 0);
+                               zend_hash_update(Z_ARRVAL_PP(_SERVER), newname, sizeof(newname), (void *) &temp, sizeof(zval **), NULL);
+                       }
                }
        }
 

diff --git a/ext/phar/tests/frontcontroller23.phpt b/ext/phar/tests/frontcontroller23.phpt
index 6080e56fb56d92938395cd8b5cd3cee811921f8b..14f32dd6dbb6e06a40f55a22ebd70ab588c0c675 100644 (file)
--- a/ext/phar/tests/frontcontroller23.phpt
+++ b/ext/phar/tests/frontcontroller23.phpt
@@ -1,5 +1,5 @@
 --TEST--
-Phar front controller include from cwd test 1
+Phar front controller with generic action router test
 --SKIPIF--
 <?php if (!extension_loaded("phar")) die("skip"); ?>
 --ENV--
@@ -11,3 +11,5 @@ files/frontcontroller14.phar
 --EXPECTHEADERS--
 Content-type: text/html
 --EXPECTF--
+string(9) "/hi/there"
+string(%d) "phar://%sfrontcontroller23.php/html/index.php"
\ No newline at end of file