From c5f34c9eca28769a3cc385501ee55bf153028dc4 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Sun, 11 Sep 2016 21:37:44 -0700
Subject: [PATCH] Fix bug #73035 (Out of bound when verify signature of tar
 phar in phar_parse_tarfile)

(cherry picked from commit 75ebf471ff46ec6e5ee279b3650c11d51ebaf9e3)
---
 ext/phar/tar.c               |   2 +-
 ext/phar/tests/bug73035.phpt |  18 ++++++++++++++++++
 ext/phar/tests/bug73035.tar  | Bin 0 -> 10240 bytes
 3 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 ext/phar/tests/bug73035.phpt
 create mode 100644 ext/phar/tests/bug73035.tar

diff --git a/ext/phar/tar.c b/ext/phar/tar.c
index aeb5c7ef1e..72b653db97 100644
--- a/ext/phar/tar.c
+++ b/ext/phar/tar.c
@@ -286,7 +286,7 @@ bail:
 			}
 			curloc = php_stream_tell(fp);
 			read = php_stream_read(fp, buf, size);
-			if (read != size) {
+			if (read != size || read <= 8) {
 				if (error) {
 					spprintf(error, 4096, "phar error: tar-based phar \"%s\" signature cannot be read", fname);
 				}
diff --git a/ext/phar/tests/bug73035.phpt b/ext/phar/tests/bug73035.phpt
new file mode 100644
index 0000000000..5928428abc
--- /dev/null
+++ b/ext/phar/tests/bug73035.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Phar: #73035 (Out of bound when verify signature of tar phar in phar_parse_tarfile)
+--SKIPIF--
+<?php if (!extension_loaded("phar")) die("skip"); ?>
+--FILE--
+<?php
+chdir(__DIR__);
+try {
+$phar = new PharData('bug73035.tar');
+var_dump($phar);
+} catch(UnexpectedValueException $e) {
+	print $e->getMessage()."\n";
+}
+?>
+DONE
+--EXPECTF--
+phar error: tar-based phar "%sbug73035.tar" signature cannot be read
+DONE
\ No newline at end of file
diff --git a/ext/phar/tests/bug73035.tar b/ext/phar/tests/bug73035.tar
new file mode 100644
index 0000000000000000000000000000000000000000..d8e426866bdebf469d479d54d50da4620caffe1d
GIT binary patch
literal 10240
zcmeIuK?;K~5CFhDp-;#QtQGM;DU{ZWl&Jr2q~M`=kqTaBFAKX#b~DxcmGX7$pF^7F
z{HX5z5RQ(zMAx=q$t8YsDXqP4|JHPE6JmYzB3tjx<CJoYTdiHSW%Cm2=XPB_@9^ck
x(IyihK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!Cs>0v~E`76JeO

literal 0
HcmV?d00001

-- 
2.40.0