[GIT-PULLS] [php-src] PR #23442: Fix GH-23418: UAF when accessing mounted Phar subdirectories

[email protected] (LamentXU123)
Newsgroups php.git-pulls
Message-ID <[email protected]>
Pull Request: https://github.com/php/php-src/pull/23442
Author: LamentXU123

The UAF is basically because we trick the `phar_mount_entry` to fail and the code goes to

```c
				if (SUCCESS != phar_mount_entry(phar, test, test_len, path, path_len)) {
					efree(test);
					if (error) {
						spprintf(error, 4096, "phar error: path \"%s\" exists as file \"%s\" and could not be mounted", path, test);
					}
```

Self-evidence buggy code I'd say... we freed test and use it in spprintf. Haha.

Here we passes a properly null-terminated copy of the shortened path to `phar_mount_entry()` instead and keep `test` alive until error formatting and manifest lookup have completed.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.