CVE-2016-10160: Off-by-one Error (CWE-193)
value: Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 9.8
Published: 2017-01-24T21:59Z
Repository: https://github.com/php/php-src
Language: C
Files changed: ext/phar/phar.c, ext/phar/tests/bug73768.phpt
Commit date: 2016-12-30 15:57:24 -0800
Commit message: Fix bug #73768 - Memory corruption when loading hostile phar

Diff: diff --git a/ext/phar/phar.c b/ext/phar/phar.c
index 532b4c3169a..158f41739dc 100644
--- a/ext/phar/phar.c
+++ b/ext/phar/phar.c
@@ -979,19 +979,18 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 	/* tmp_len = 0 says alias length is 0, which means the alias is not stored in the phar */
 	if (tmp_len) {
 		/* if the alias is stored we enforce it (implicit overrides explicit) */
 		if (alias && alias_len && (alias_len != (int)tmp_len || strncmp(alias, buffer, tmp_len)))
 		{
-			buffer[tmp_len] = '\0';
 			php_stream_close(fp);
 
 			if (signature) {
 				efree(signature);
 			}
 
 			if (error) {
-				spprintf(error, 0, "cannot load phar \"%s\" with implicit alias \"%s\" under different alias \"%s\"", fname, buffer, alias);
+				spprintf(error, 0, "cannot load phar \"%s\" with implicit alias \"%.*s\" under different alias \"%s\"", fname, tmp_len, buffer, alias);
 			}
 
 			efree(savebuf);
 			return FAILURE;
 		}
diff --git a/ext/phar/tests/bug73768.phar b/ext/phar/tests/bug73768.phar
new file mode 100644
index 00000000000..3f429c23650
Binary files /dev/null and b/ext/phar/tests/bug73768.phar differ
diff --git a/ext/phar/tests/bug73768.phpt b/ext/phar/tests/bug73768.phpt
new file mode 100644
index 00000000000..37a4da0253a
--- /dev/null
+++ b/ext/phar/tests/bug73768.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Phar: PHP bug #73768: Memory corruption when loading hostile phar
+--SKIPIF--
+<?php if (!extension_loaded("phar")) die("skip"); ?>
+--FILE--
+<?php
+chdir(__DIR__);
+try {
+$p = Phar::LoadPhar('bug73768.phar', 'alias.phar');
+echo "OK\n";
+} catch(PharException $e) {
+	echo $e->getMessage();
+}
+?>
+--EXPECTF--
+cannot load phar "%sbug73768.phar" with implicit alias "" under different alias "alias.phar"

Vulnerable code: 			buffer[tmp_len] = '\0';
				spprintf(error, 0, "cannot load phar \"%s\" with implicit alias \"%s\" under different alias \"%s\"", fname, buffer, alias);
Fixed code: 				spprintf(error, 0, "cannot load phar \"%s\" with implicit alias \"%.*s\" under different alias \"%s\"", fname, tmp_len, buffer, alias);
--TEST--
Phar: PHP bug #73768: Memory corruption when loading hostile phar
--SKIPIF--
<?php if (!extension_loaded("phar")) die("skip"); ?>
--FILE--
<?php
chdir(__DIR__);
try {
$p = Phar::LoadPhar('bug73768.phar', 'alias.phar');
echo "OK\n";
} catch(PharException $e) {
	echo $e->getMessage();
}
?>
--EXPECTF--
cannot load phar "%sbug73768.phar" with implicit alias "" under different alias "alias.phar"