mirror of
https://github.com/thead-yocto-mirror/meta-openembedded
synced 2026-08-23 09:18:23 +02:00
889258fd3a
CVE-2015-7804 php: uninitialized pointer in phar_make_dirstream() Signed-off-by: Armin Kuster <akuster@mvista.com>
65 lines
2.1 KiB
Diff
65 lines
2.1 KiB
Diff
From e78ac461dbefb7c4a3e9fde78d50fbc56b7b0183 Mon Sep 17 00:00:00 2001
|
|
From: Stanislav Malyshev <stas@php.net>
|
|
Date: Mon, 28 Sep 2015 17:12:35 -0700
|
|
Subject: [PATCH] FIx bug #70433 - Uninitialized pointer in phar_make_dirstream
|
|
when zip entry filename is "/"
|
|
|
|
Upstream-Status: Backport
|
|
|
|
https://git.php.net/?p=php-src.git;a=patch;h=e78ac461dbefb7c4a3e9fde78d50fbc56b7b0183
|
|
|
|
excluded the zip part of the original patch. Hand applied dirstream change
|
|
|
|
CVE: CVE-2015-7804
|
|
Signed-off-by: Armin Kuster <akuster@mvista.com>
|
|
|
|
---
|
|
ext/phar/dirstream.c | 2 +-
|
|
ext/phar/tests/bug70433.phpt | 23 +++++++++++++++++++++++
|
|
ext/phar/tests/bug70433.zip | Bin 0 -> 264 bytes
|
|
3 files changed, 24 insertions(+), 1 deletion(-)
|
|
create mode 100644 ext/phar/tests/bug70433.phpt
|
|
create mode 100755 ext/phar/tests/bug70433.zip
|
|
|
|
Index: php-5.6.12/ext/phar/dirstream.c
|
|
===================================================================
|
|
--- php-5.6.12.orig/ext/phar/dirstream.c
|
|
+++ php-5.6.12/ext/phar/dirstream.c
|
|
@@ -198,7 +198,7 @@ static php_stream *phar_make_dirstream(c
|
|
zend_hash_internal_pointer_reset(manifest);
|
|
|
|
while (FAILURE != zend_hash_has_more_elements(manifest)) {
|
|
- if (HASH_KEY_NON_EXISTENT == zend_hash_get_current_key_ex(manifest, &str_key, &keylen, &unused, 0, NULL)) {
|
|
+ if (HASH_KEY_IS_STRING != zend_hash_get_current_key_ex(manifest, &str_key, &keylen, &unused, 0, NULL)) {
|
|
break;
|
|
}
|
|
|
|
Index: php-5.6.12/ext/phar/tests/bug70433.phpt
|
|
===================================================================
|
|
--- /dev/null
|
|
+++ php-5.6.12/ext/phar/tests/bug70433.phpt
|
|
@@ -0,0 +1,23 @@
|
|
+--TEST--
|
|
+Phar - bug #70433 - Uninitialized pointer in phar_make_dirstream when zip entry filename is "/"
|
|
+--SKIPIF--
|
|
+<?php if (!extension_loaded("phar")) die("skip"); ?>
|
|
+--FILE--
|
|
+<?php
|
|
+$phar = new PharData(__DIR__."/bug70433.zip");
|
|
+var_dump($phar);
|
|
+$meta = $phar->getMetadata();
|
|
+var_dump($meta);
|
|
+?>
|
|
+DONE
|
|
+--EXPECTF--
|
|
+object(PharData)#1 (3) {
|
|
+ ["pathName":"SplFileInfo":private]=>
|
|
+ string(0) ""
|
|
+ ["glob":"DirectoryIterator":private]=>
|
|
+ bool(false)
|
|
+ ["subPathName":"RecursiveDirectoryIterator":private]=>
|
|
+ string(0) ""
|
|
+}
|
|
+NULL
|
|
+DONE
|