Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Step:15-SP1
php7.27346
php7-CVE-2022-31628.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File php7-CVE-2022-31628.patch of Package php7.27346
Index: php-7.2.34/ext/phar/phar.c =================================================================== --- php-7.2.34.orig/ext/phar/phar.c +++ php-7.2.34/ext/phar/phar.c @@ -1576,6 +1576,7 @@ static int phar_open_from_fp(php_stream* const char gz_magic[] = "\x1f\x8b\x08"; const char bz_magic[] = "BZh"; char *pos, test = '\0'; + int recursion_count = 3; // arbitrary limit to avoid too deep or even infinite recursion const int window_size = 1024; char buffer[1024 + sizeof(token)]; /* a 1024 byte window + the size of the halt_compiler token (moving window) */ const zend_long readsize = sizeof(buffer) - sizeof(token); @@ -1603,7 +1604,7 @@ static int phar_open_from_fp(php_stream* MAPPHAR_ALLOC_FAIL("internal corruption of phar \"%s\" (truncated entry)") } - if (!test) { + if (!test && recursion_count) { test = '\1'; pos = buffer+tokenlen; if (!memcmp(pos, gz_magic, 3)) { @@ -1665,6 +1666,10 @@ static int phar_open_from_fp(php_stream* /* now, start over */ test = '\0'; + if (!--recursion_count) { + MAPPHAR_ALLOC_FAIL("unable to decompress gzipped phar archive \"%s\""); + break; + } continue; } else if (!memcmp(pos, bz_magic, 3)) { php_stream_filter *filter; @@ -1703,6 +1708,10 @@ static int phar_open_from_fp(php_stream* /* now, start over */ test = '\0'; + if (!--recursion_count) { + MAPPHAR_ALLOC_FAIL("unable to decompress bzipped phar archive \"%s\""); + break; + } continue; }
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor