Patch fix-phar-uaf for PHAR related Bug #77919
Patch version 2019-04-18 14:03 UTC
Return to Bug #77919 |
Download this patch
Patch Revisions:
Developer: cmb@php.net
ext/phar/phar_object.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
index f2e65b32f0..ed5c546adc 100644
--- a/ext/phar/phar_object.c
+++ b/ext/phar/phar_object.c
@@ -1990,7 +1990,7 @@ static zend_object *phar_rename_archive(phar_archive_data **sphar, char *ext) /*
char *newname = NULL, *newpath = NULL;
zval ret, arg1;
zend_class_entry *ce;
- char *error;
+ char *error = NULL;
const char *pcr_error;
size_t ext_len = ext ? strlen(ext) : 0;
size_t new_len, oldname_len, phar_ext_len;
@@ -2200,6 +2200,8 @@ its_ok:
phar_flush(phar, 0, 0, 1, &error);
if (error) {
+ zend_hash_str_del(&(PHAR_G(phar_fname_map)), newpath, phar->fname_len);
+ *sphar = NULL;
zend_throw_exception_ex(spl_ce_BadMethodCallException, 0, "%s", error);
efree(error);
efree(oldpath);
|