Fix bug #69720: Null pointer dereference in phar_get_fp_offset()

diff --git a/ext/phar/tests/bug69720.phar b/ext/phar/tests/bug69720.phar
new file mode 100644 (file)
index 0000000..f62fb11
Binary files /dev/null and b/ext/phar/tests/bug69720.phar differ

diff --git a/ext/phar/tests/bug69720.phpt b/ext/phar/tests/bug69720.phpt
new file mode 100644 (file)
index 0000000..43b701d
--- /dev/null
+++ b/ext/phar/tests/bug69720.phpt
@@ -0,0 +1,40 @@
+--TEST--
+Phar - bug #69720 - Null pointer dereference in phar_get_fp_offset()
+--SKIPIF--
+<?php if (!extension_loaded("phar")) die("skip"); ?>
+--FILE--
+<?php
+try {
+    // open an existing phar
+    $p = new Phar(__DIR__."/bug69720.phar",0);
+    // Phar extends SPL's DirectoryIterator class
+       echo $p->getMetadata();
+    foreach (new RecursiveIteratorIterator($p) as $file) {
+        // $file is a PharFileInfo class, and inherits from SplFileInfo
+       $temp="";
+        $temp= $file->getFileName() . "\n";
+        $temp.=file_get_contents($file->getPathName()) . "\n"; // display contents
+       var_dump($file->getMetadata());
+    }
+}
+ catch (Exception $e) {
+    echo 'Could not open Phar: ', $e;
+}
+?>
+--EXPECTF--
+
+MY_METADATA_NULL
+
+Warning: file_get_contents(phar:///%s): failed to open stream: phar error: "test.php" is not a file in phar "%s.phar" in %s.php on line %d
+array(1) {
+  ["whatever"]=>
+  int(123)
+}
+object(DateTime)#2 (3) {
+  ["date"]=>
+  string(26) "2000-01-01 00:00:00.000000"
+  ["timezone_type"]=>
+  int(3)
+  ["timezone"]=>
+  string(3) "UTC"
+}

diff --git a/ext/phar/util.c b/ext/phar/util.c
index d561342ccaebea0efa6541ecb6a1422b05f5dfd2..54a928618bd4b811a684be81e1a3c5c53101f689 100644 (file)
--- a/ext/phar/util.c
+++ b/ext/phar/util.c
@@ -493,7 +493,11 @@ really_get_entry:
        (*ret)->is_tar = entry->is_tar;
        (*ret)->fp = phar_get_efp(entry, 1);
        if (entry->link) {
-               (*ret)->zero = phar_get_fp_offset(phar_get_link_source(entry));
+               phar_entry_info *link = phar_get_link_source(entry);
+               if(!link) {
+                       return FAILURE;
+               }
+               (*ret)->zero = phar_get_fp_offset(link);
        } else {
                (*ret)->zero = phar_get_fp_offset(entry);
        }