From 034a12341f46d9e65c1e4de5bcdab4851c02192e Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sat, 8 Jul 2023 20:17:04 +0200
Subject: [PATCH] Add missing check on EVP_VerifyUpdate() in phar util

---
 ext/phar/util.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/ext/phar/util.c b/ext/phar/util.c
index d0e427627037..753c8d31b1fc 100644
--- a/ext/phar/util.c
+++ b/ext/phar/util.c
@@ -1599,7 +1599,9 @@ int phar_verify_signature(php_stream *fp, size_t end_of_phar, uint32_t sig_type,
 			php_stream_seek(fp, 0, SEEK_SET);
 
 			while (read_size && (len = php_stream_read(fp, (char*)buf, read_size)) > 0) {
-				EVP_VerifyUpdate (md_ctx, buf, len);
+				if (UNEXPECTED(EVP_VerifyUpdate (md_ctx, buf, len) == 0)) {
+					goto failure;
+				}
 				read_len -= (zend_off_t)len;
 
 				if (read_len < read_size) {
@@ -1608,6 +1610,7 @@ int phar_verify_signature(php_stream *fp, size_t end_of_phar, uint32_t sig_type,
 			}
 
 			if (EVP_VerifyFinal(md_ctx, (unsigned char *)sig, sig_len, key) != 1) {
+				failure:
 				/* 1: signature verified, 0: signature does not match, -1: failed signature operation */
 				EVP_PKEY_free(key);
 				EVP_MD_CTX_destroy(md_ctx);