[GIT-PULLS] [php-src] PR #22768: ext/standard: fix out-of-bounds access in the ftp:// directory stream
[email protected] (iliaal) Thu, 16 Jul 2026 16:39:50 +0000
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/22768 Author: iliaal `php_ftp_dirstream_read()` sized the basename copy with `MIN(sizeof, len - 1)` and terminated at `[tmp_len - 1]`. An empty listing line gives a basename of length 1, so tmp_len is 0 and the terminator lands one byte before d_name; a slash-only line gives length 0, so len - 1 underflows to SIZE_MAX and memcpy reads 4096 bytes past the interned empty string. ASAN flags both. The same off-by-one truncated entry names that do not end in CRLF, which opendir-002 and opendir-004 had baked in as expected output. Floor: PHP-8.4.