add constraint check for number of manifest entries, and test

diff --git a/ext/phar/phar.c b/ext/phar/phar.c
index a414742c8e2f96f99019360b81791cbed86839fd..d3b763aff4f7f75792fb2888c837b21ffcb7dfa4 100644 (file)
--- a/ext/phar/phar.c
+++ b/ext/phar/phar.c
@@ -237,6 +237,11 @@ PHP_METHOD(PHP_Archive, mapPhar)
        }
        /* extract the number of entries */
        PHAR_GET_VAL(manifest_count)
+       /* we have 4 32-bit items and each must contain a file name at least 1 byte in length */
+       if (manifest_count > (manifest_len / (4 * 5 + 1))) {
+               /* prevent serious memory issues */
+               MAPPHAR_FAIL("too many manifest entries for size of manifest in phar \"%s\"")
+       }
        /* set up our manifest */
        ALLOC_HASHTABLE(manifest);
        zend_hash_init(manifest, sizeof(phar_manifest_entry),

diff --git a/ext/phar/tests/008.phpt b/ext/phar/tests/008.phpt
index d101ba3cd1f73d8fd324e5aa8468b96124fc30e7..9038512112040dee974ae850b3a1c77165b9f1c3 100644 (file)
--- a/ext/phar/tests/008.phpt
+++ b/ext/phar/tests/008.phpt
@@ -12,8 +12,6 @@ __HALT_COMPILER(); ?>";
 $file .= pack('V', 500) . 'notenough';
 file_put_contents(dirname(__FILE__) . '/008_phar.php', $file);
 include dirname(__FILE__) . '/008_phar.php';
-exit;
-PHP_Archive::mapPhar(5, 'hio', false);
-__HALT_COMPILER(); ?>
+?>
 --EXPECTF--
 Fatal error: PHP_Archive::mapPhar(): internal corruption of phar "%s" (truncated manifest) in %s on line %d
\ No newline at end of file

diff --git a/ext/phar/tests/009.phpt b/ext/phar/tests/009.phpt
new file mode 100644 (file)
index 0000000..d2de92d
--- /dev/null
+++ b/ext/phar/tests/009.phpt
@@ -0,0 +1,17 @@
+--TEST--
+PHP_Archive::mapPhar improper parameters
+--SKIPIF--
+<?php if (!extension_loaded("phar")) print "skip";?>
+--FILE--
+<?php
+function cleanup() { unlink(dirname(__FILE__) . '/008_phar.php'); }
+register_shutdown_function('cleanup');
+$file = "<?php
+PHP_Archive::mapPhar(5, 'hio', false);
+__HALT_COMPILER(); ?>";
+$file .= pack('VV', 500, 500) . str_repeat('A', 500);
+file_put_contents(dirname(__FILE__) . '/008_phar.php', $file);
+include dirname(__FILE__) . '/008_phar.php';
+?>
+--EXPECTF--
+Fatal error: PHP_Archive::mapPhar(): too many manifest entries for size of manifest in phar "%s" in %s on line %d
\ No newline at end of file