Skip to content

Commit 3e87cfa

Browse files
committed
Merge branch 'PHP-8.5'
* PHP-8.5: Fix GH-20732: Phar::LoadPhar undefined behavior when loading directory
2 parents cec087e + 66d4441 commit 3e87cfa

File tree

2 files changed

+16
-2
lines changed

2 files changed

+16
-2
lines changed

ext/phar/phar.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1571,7 +1571,7 @@ static zend_result phar_open_from_fp(php_stream* fp, char *fname, size_t fname_l
15711571
const zend_long readsize = sizeof(buffer) - sizeof(token);
15721572
const zend_long tokenlen = sizeof(token) - 1;
15731573
zend_long halt_offset;
1574-
size_t got;
1574+
ssize_t got;
15751575
uint32_t compression = PHAR_FILE_COMPRESSED_NONE;
15761576

15771577
if (error) {
@@ -1589,7 +1589,7 @@ static zend_result phar_open_from_fp(php_stream* fp, char *fname, size_t fname_l
15891589
/* Maybe it's better to compile the file instead of just searching, */
15901590
/* but we only want the offset. So we want a .re scanner to find it. */
15911591
while(!php_stream_eof(fp)) {
1592-
if ((got = php_stream_read(fp, buffer+tokenlen, readsize)) < (size_t) tokenlen) {
1592+
if ((got = php_stream_read(fp, buffer+tokenlen, readsize)) < tokenlen) {
15931593
MAPPHAR_ALLOC_FAIL("internal corruption of phar \"%s\" (truncated entry)")
15941594
}
15951595

ext/phar/tests/gh20732.phpt

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
--TEST--
2+
GH-20732 (Phar::LoadPhar undefined behavior when loading directory)
3+
--EXTENSIONS--
4+
phar
5+
--FILE--
6+
<?php
7+
try {
8+
@Phar::LoadPhar('.');
9+
} catch (PharException $e) {
10+
echo $e->getMessage(), "\n";
11+
}
12+
?>
13+
--EXPECTF--
14+
%r(internal corruption of phar "%s" \(truncated entry\)|unable to open phar for reading ".")%r

0 commit comments

Comments
 (0)