php/sme8/php-5.3.3-CVE-2012-2386.patch


https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2386

http://git.php.net/?p=php-src.git;a=commit;h=158d8a6b088662ce9d31e0c777c6ebe90efdc854

--- php-5.3.3/ext/phar/tar.c.cve2386
+++ php-5.3.3/ext/phar/tar.c
@@ -38,7 +38,7 @@ static php_uint32 phar_tar_number(char *
 /* }}} */
 
 /* adapted from format_octal() in libarchive
- * 
+ *
  * Copyright (c) 2003-2009 Tim Kientzle
  * All rights reserved.
  *
@@ -161,7 +161,7 @@ static int phar_tar_process_metadata(pha
        size_t save = php_stream_tell(fp), read;
        phar_entry_info *mentry;
 
-       metadata = (char *) emalloc(entry->uncompressed_filesize + 1);
+       metadata = (char *) safe_emalloc(1, entry->uncompressed_filesize, 1);
 
        read = php_stream_read(fp, metadata, entry->uncompressed_filesize);
        if (read != entry->uncompressed_filesize) {
@@ -367,7 +367,7 @@ bail:
                        }
 
                        read = php_stream_read(fp, buf, sizeof(buf));
-       
+
                        if (read != sizeof(buf)) {
                                efree(entry.filename);
                                if (error) {
1	slords	1.2
2			https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2386
3
4			http://git.php.net/?p=php-src.git;a=commit;h=158d8a6b088662ce9d31e0c777c6ebe90efdc854
5
6			--- php-5.3.3/ext/phar/tar.c.cve2386
7			+++ php-5.3.3/ext/phar/tar.c
8			@@ -38,7 +38,7 @@ static php_uint32 phar_tar_number(char *
9			/* }}} */
10
11			/* adapted from format_octal() in libarchive
12			- *
13			+ *
14			* Copyright (c) 2003-2009 Tim Kientzle
15			* All rights reserved.
16			*
17			@@ -161,7 +161,7 @@ static int phar_tar_process_metadata(pha
18			size_t save = php_stream_tell(fp), read;
19			phar_entry_info *mentry;
20
21			- metadata = (char *) emalloc(entry->uncompressed_filesize + 1);
22			+ metadata = (char *) safe_emalloc(1, entry->uncompressed_filesize, 1);
23
24			read = php_stream_read(fp, metadata, entry->uncompressed_filesize);
25			if (read != entry->uncompressed_filesize) {
26			@@ -367,7 +367,7 @@ bail:
27			}
28
29			read = php_stream_read(fp, buf, sizeof(buf));
30			-
31			+
32			if (read != sizeof(buf)) {
33			efree(entry.filename);
34			if (error) {