Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:42762
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 72.14.220.158 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :cc:content-type;
        b=Bc6LiafqbLjyHLtYdpor6UqoJvfW9Zr9+FeOAhwE++kpajhFd0jPpuHurAFm8jVKW1
         Th9fYQmoUaYROkY93LJoVtm0O+QOu84UiReBqaLIt6bXOnJE6e7cRoYIl9gC9cEHw5Ms
         eNDCZg6Nq948AlIVnqlfo6PgPWe5AznzYLbMI=
MIME-Version: 1.0
In-Reply-To: <fe05d1540901211425t2b72592ep755f09ffeb34dc49@mail.gmail.com>
References: <20090121215750.GC15208@rangda.stickybit.se>
	 <fe05d1540901211425t2b72592ep755f09ffeb34dc49@mail.gmail.com>
Date: Thu, 22 Jan 2009 00:54:38 +0100
Message-ID: <fe05d1540901211554t7ea7b3d7x74b5aff96b1b587b@mail.gmail.com>
To: sean finney <seanius@debian.org>
Cc: PHP internals <internals@lists.php.net>, 
	Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>, 
	Stefan Esser <sesser@hardened-php.net>
Content-Type: multipart/mixed; boundary=000e0cd2457af2d11a046106e0a2
Subject: Re: [PHP-DEV] CVE-2008-5658 unfixed or new problem with 
	Zip::extractTo in 5.2.x?
From: pierre.php@gmail.com (Pierre Joye)

--000e0cd2457af2d11a046106e0a2
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

re,

I ran a quick test to solve this problem sooner rather than later
(using only the crash.zip part):

pierre@ubuntu:~/cvs/php53/bld$ ./sapi/cli/php ./ziptest.php
opening 'bad' zipfile...ok.
extracted.


C:\Users\pierre\Documents\php-sdk\php53\vc9\x86\php53clean>Debug\php.exe
ziptest.php
opening 'bad' zipfile...ok.
extracted.

But it crashes in 5.2, it seems to be a problem in virtual_file_ex, it
return an empty string instead of the expected path.

Can you try the attached patch please? against 5.2. I backported the
necessary functions from TSRM and removed what we do not use. It
should fix the problem.

Cheers,

On Wed, Jan 21, 2009 at 11:25 PM, Pierre Joye <pierre.php@gmail.com> wrote:
> hi,
>
> On Wed, Jan 21, 2009 at 10:57 PM, sean finney <seanius@debian.org> wrote:
>> hi everyone,
>>
>> i'm looking for a sanity check here, as i've already lost more time than
>> i'd like chasing ghosts on my treasure hunt through {bugs,lists,cvs}.php.net :(
>>
>> afaict, CVE-2008-5658[1] is only half-fixed on 5.2.8, while it was supposed
>> to be fixed in 5.2.7.
>
> it is fixed in 5.2.7RC2 or RC3, see:
> http://cvs.php.net/viewvc.cgi/php-src/ext/zip/php_zip.c?r1=1.1.2.43&r2=1.1.2.44
>
>> while the zip library no longer blindly extracts files such as
>> "../../../var/www/index.php", it now seems to segfault on any files
>> that have a leading "..".  I've put some sample code illustrating my
>> problem at[2].  am i on crack?
>
> No idea, can you open a bug and post the backtrace, a zip data to
> reproduce the problem and a simple script please? Simply post the
> links you gave here. I will take a look at them as soon as possible.
>
> Thanks for the report!
>
> Cheers,
> --
> Pierre
>
> http://blog.thepimp.net | http://www.libgd.org
>



-- 
Pierre

http://blog.thepimp.net | http://www.libgd.org

--000e0cd2457af2d11a046106e0a2--