Fix # 79171: heap-buffer-overflow in phar_extract_file

We must not access memory outside of the allocated buffer.

diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
index 14b4a795d01edb8581d80c537c4fbee05debd1b3..82c7c376edd7246f2701470f5d1b63018cd33d0c 100644 (file)
--- a/ext/phar/phar_object.c
+++ b/ext/phar/phar_object.c
@@ -4153,7 +4153,7 @@ static int phar_extract_file(zend_bool overwrite, phar_entry_info *entry, char *
                        if ('\\' == filename[cnt]) {
                                filename[cnt] = '/';
                        }
-               } while (cnt++ <= filename_len);
+               } while (cnt++ < filename_len);
        }
 #endif