Out-of-bounds write in the php-src PHAR extension risks heap corruption and remote code execution
Attackers craft request URIs with a specific ending to trigger a logic flaw in zim_Phar_webPhar. The code incorrectly uses the full server-side path length instead of the base filename length when computing the offset, so the pointer lands past the end of the SAPI request_uri buffer. That causes a heap buffer over-read and a single-byte NUL out-of-bounds write. The memory corruption can overwrite critical data structures, crash the process, or enable remote arbitrary code execution, seriously threatening integrity and availability.
Component
php-src is the core source repository of the PHP interpreter. Its built-in PHAR extension provides JAR-like archive and stream handling for PHP. In non-CGI SAPI modes such as the CLI server, the webPhar function handles 301 redirect requests, parses URI paths, and maps them to PHAR files in nested local directories so static resources can be auto-distributed and routed.
Type
Out-of-bounds Write (CWE-787)
Repo
github.com/php/php-src
· Stars 41758
Remediation
- Correct the length calculation so offsets use the proper base filename length, add strict bounds checks on pointer ranges to prevent buffer overflows, and disable unnecessary PHAR auto-loading in production to shrink the attack surface.
