CVE-2015-3307: Buffer Overflow

A vulnerability in PHP was reported whereby the Heap header gets misaligned resulting in the corruption of the heap chunk's metadata.

A heap chunk is allocated in ext/phar/tar.c:167

metadata = (char ) safeemalloc(1, entry->uncompressedfilesize, 1);

A reference to this heap chunk is passed into pharparsemetadata() at ext/phar/tar.c:176

if (pharparsemetadata(&metadata, &entry->metadata, entry->uncompressedfilesize TSRMLSCC) == FAILURE) {

The following gets called within pharparsemetadata:611 when zipmetadatalen==0

PHARGET32(buffer, buflen);

This moves the pointer referencing the heap chunk by 4 bytes.

When the heap chunk gets freeed at at tar.c:177:

efree(metadata);

The heap chunk is now misaligned by 4 bytes. In other words: ZENDMMHEADEROF(metadata).info.size is now ZENDMMHEADEROF(metadata).info.prev and ZENDMMHEADEROF(metadata).info.prev is tainted with the body's data.

Upstream bug: https://bugs.php.net/bug.php?id=69443

Upstream patch: http://git.php.net/?p=php-src.git;a=commitdiff;h=17cbd0b5b78a7500f185b3781a2149881bfff8ae

This patch was for CVE-2015-2783 (bug 1213446), but it inadvertently resolved this vulnerability as well. The vulnerable line that was removed was on ext/phar/phar.c:611

PHARGET32(buffer, buflen);