Fix # 79171: heap-buffer-overflow in phar_extract_file

cmb69 · smalyshev · commit 7248341ea6b1 · 2020-02-17T00:20:31.000-08:00
We must not access memory outside of the allocated buffer.
diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
@@ -4199,7 +4199,7 @@ static int phar_extract_file(zend_bool overwrite, phar_entry_info *entry, char *
 			if ('\\' == filename[cnt]) {
 				filename[cnt] = '/';
 			}
-		} while (cnt++ <= filename_len);
+		} while (cnt++ < filename_len);
 	}
 #endif
 

Original file line number	Diff line number	Diff line change
`@@ -4199,7 +4199,7 @@ static int phar_extract_file(zend_bool overwrite, phar_entry_info entry, char `
`4199`	`4199`	`if ('\\' == filename[cnt]) {`
`4200`	`4200`	`filename[cnt] = '/';`
`4201`	`4201`	`}`
`4202`		`- } while (cnt++ <= filename_len);`
	`4202`	`+ } while (cnt++ < filename_len);`
`4203`	`4203`	`}`
`4204`	`4204`	`#endif`
`4205`	`4205`