[GIT-PULLS] [php-src] PR #23442: Fix GH-23418: UAF when accessing mounted Phar subdirectories
[email protected] (LamentXU123)
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/23442
Author: LamentXU123
The UAF is basically because we trick the `phar_mount_entry` to fail and the code goes to
```c
if (SUCCESS != phar_mount_entry(phar, test, test_len, path, path_len)) {
efree(test);
if (error) {
spprintf(error, 4096, "phar error: path \"%s\" exists as file \"%s\" and could not be mounted", path, test);
}
```
Self-evidence buggy code I'd say... we freed test and use it in spprintf. Haha.
Here we passes a properly null-terminated copy of the shortened path to `phar_mount_entry()` instead and keep `test` alive until error formatting and manifest lookup have completed.