Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 13 Mar 2016 11:01:33 +0200
From: Dmitry Kasyanov <>
Subject: CVE Request: PHP-5.5.33: Out-of-Bound Read in phar_parse_zipfile

An out-of-bounds read vulnerability was found in PHAR's
phar_parse_zipfile() function.

Vulnerable code:


int phar_parse_zipfile(php_stream *fp, char *fname, int fname_len,
char *alias, int alias_len, phar_archive_data** pphar, char **error)
/* {{{ */
phar_zip_dir_end locator;
char buf[sizeof(locator) + 65536];
while ((p=(char *) memchr(p + 1, 'P', (size_t) (size - (p + 1 -
buf)))) != NULL) {
if (!memcmp(p + 1, "K\5\6", 3)) {
memcpy((void *)&locator, (void *) p, sizeof(locator));
if (PHAR_GET_16(locator.centraldisk) != 0 ||
PHAR_GET_16(locator.disknumber) != 0) {
/* split archives not handled */
if (error) {
spprintf(error, 4096, "phar error: split archives spanning multiple
zips cannot be processed in zip-based phar \"%s\"", fname);
return FAILURE;

The above code block tries to determine where in buf is "PK\x05\x06",
which is actually "End of central directory record" structure of zip
file. Then it copies 0x16 bytes from there to `phar_zip_dir_end
locator`. If "PK\x05\x06" signature is located at end of `buf`
variable, it will read out-of-bound `buf` variable and copy to

Details available at PHP bug tracker:


Dmitry Kasyanov  |  Developer

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.