Fix #77322: PharData::addEmptyDir('/') Possible integer overflow

`phar_path_check()` already strips a leading slash, so we must not
attempt to strip the trailing slash from an now empty directory name.

Closes GH-6508.

diff --git a/NEWS b/NEWS
index 80c3cdd9c73a4dfa05178bc53704ba44287dc66b..06781af7dbc3fa69c3fac55c2171966e973e4f85 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -31,7 +31,9 @@ PHP                                                                        NEWS
 
 - Phar:
   . Fixed bug #73809 (Phar Zip parse crash - mmap fail). (cmb)
-  . Fixed #75102 (`PharData` says invalid checksum for valid tar). (cmb)
+  . Fixed bug #75102 (`PharData` says invalid checksum for valid tar). (cmb)
+  . Fixed bug #77322 (PharData::addEmptyDir('/') Possible integer overflow).
+    (cmb)
 
 - PDO MySQL:
   . Fixed bug #80458 (PDOStatement::fetchAll() throws for upsert queries).

diff --git a/ext/phar/tests/bug77322.phpt b/ext/phar/tests/bug77322.phpt
new file mode 100644 (file)
index 0000000..b9e5ce4
--- /dev/null
+++ b/ext/phar/tests/bug77322.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #77322 (PharData::addEmptyDir('/') Possible integer overflow)
+--SKIPIF--
+<?php
+if (!extension_loaded('phar')) die('skip phar extension not available');
+?>
+--FILE--
+<?php
+$zip = new PharData(__DIR__ . '/bug77322.zip');
+$zip->addEmptyDir('/');
+var_dump($zip->count());
+
+$tar = new PharData(__DIR__ . '/bug77322.tar');
+$tar->addEmptyDir('/');
+var_dump($tar->count());
+?>
+--EXPECT--
+int(1)
+int(1)
+--CLEAN--
+<?php
+unlink(__DIR__ . '/bug77322.zip');
+unlink(__DIR__ . '/bug77322.tar');
+?>

diff --git a/ext/phar/util.c b/ext/phar/util.c
index 53982b0f85206fa6e91fd3b425a0cf81c9eebda4..354f0dbaacb854703295793a83d743a7cf293531 100644 (file)
--- a/ext/phar/util.c
+++ b/ext/phar/util.c
@@ -567,7 +567,7 @@ phar_entry_data *phar_get_or_create_entry_data(char *fname, size_t fname_len, ch
        } else {
                etemp.flags = etemp.old_flags = PHAR_ENT_PERM_DEF_FILE;
        }
-       if (is_dir) {
+       if (is_dir && path_len) {
                etemp.filename_len--; /* strip trailing / */
                path_len--;
        }