oss-sec mailing list archives
CVE Request: PHP-5.5.33: Out-of-Bound Read in phar_parse_zipfile
From: Dmitry Kasyanov <dkasyanov () cloudlinux com>
Date: Sun, 13 Mar 2016 11:01:33 +0200
An out-of-bounds read vulnerability was found in PHAR's phar_parse_zipfile() function. Vulnerable code: ext/phar/zip.c: int phar_parse_zipfile(php_stream *fp, char *fname, int fname_len, char *alias, int alias_len, phar_archive_data** pphar, char **error) /* {{{ */ { phar_zip_dir_end locator; char buf[sizeof(locator) + 65536]; ... while ((p=(char *) memchr(p + 1, 'P', (size_t) (size - (p + 1 - buf)))) != NULL) { if (!memcmp(p + 1, "K\5\6", 3)) { memcpy((void *)&locator, (void *) p, sizeof(locator)); if (PHAR_GET_16(locator.centraldisk) != 0 || PHAR_GET_16(locator.disknumber) != 0) { /* split archives not handled */ php_stream_close(fp); if (error) { spprintf(error, 4096, "phar error: split archives spanning multiple zips cannot be processed in zip-based phar \"%s\"", fname); } return FAILURE; } ... The above code block tries to determine where in buf is "PK\x05\x06", which is actually "End of central directory record" structure of zip file. Then it copies 0x16 bytes from there to `phar_zip_dir_end locator`. If "PK\x05\x06" signature is located at end of `buf` variable, it will read out-of-bound `buf` variable and copy to `locator`. Details available at PHP bug tracker: https://bugs.php.net/bug.php?id=71498 Patch: https://git.php.net/?p=php-src.git;a=commit;h=a6fdc5bb27b20d889de0cd29318b3968aabb57bd -- Dmitry Kasyanov | Developer dkasyanov () cloudlinux com
Current thread:
- CVE Request: PHP-5.5.33: Out-of-Bound Read in phar_parse_zipfile Dmitry Kasyanov (Mar 13)
- Re: CVE Request: PHP-5.5.33: Out-of-Bound Read in phar_parse_zipfile cve-assign (Mar 13)