Skip to content

Fix GH-23418: UAF when accessing mounted Phar subdirectories - #23442

Merged
LamentXU123 merged 1 commit into
php:PHP-8.4from
LamentXU123:phar-f
Aug 26, 2026
Merged

Fix GH-23418: UAF when accessing mounted Phar subdirectories#23442
LamentXU123 merged 1 commit into
php:PHP-8.4from
LamentXU123:phar-f

Conversation

@LamentXU123

@LamentXU123 LamentXU123 commented Aug 25, 2026

Copy link
Copy Markdown
Member

The UAF is basically because we trick the phar_mount_entry to fail and the code goes to

if (SUCCESS != phar_mount_entry(phar, test, test_len, path, path_len)) {
	efree(test);
	if (error) {
		spprintf(error, 4096, "phar error: path \"%s\" exists as file \"%s\" and could not be mounted", path, test);
		}

Self-evident buggy code I'd say... we freed test and use it in spprintf. And guess what, the whole function repeats this insane logic later again. So this is fixing two potential UAFs.

Here we passes a properly null-terminated copy of the shortened path to phar_mount_entry() instead and keep test alive until error formatting and manifest lookup have completed.

@LamentXU123
LamentXU123 merged commit 12b1f65 into php:PHP-8.4 Aug 26, 2026
18 checks passed
@LamentXU123
LamentXU123 deleted the phar-f branch August 26, 2026 16:09
LamentXU123 added a commit that referenced this pull request Aug 26, 2026
* PHP-8.5:
  Fix GH-23418: UAF when accessing mounted Phar subdirectories (#23442)
pull Bot pushed a commit to dolfly/php-src that referenced this pull request Aug 26, 2026
* origin/PHP-8.4:
  Fix phpGH-23418: UAF when accessing mounted Phar subdirectories (php#23442)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants