ext/phar: heap buffer over-read via crafted alias size in zip-based phar (info leak via Phar::getAlias) #25089

Description

PHAR-01 — zip-based phar: alias length taken from claimed uncompressed size
Category: heap-buffer-overflow READ; CWE-125.
Context: a zip-based phar whose .phar/alias.txt central-directory and local
header declare uncompressed_filesize larger than the actual decompressed
data (PoC: claimed 0x1000, actual 4 bytes).
Observed: ASan reports heap-buffer-overflow READ of size 4096 in
phar_validate_alias (via memchr interceptor), reached through
phar_parse_zipfile from PharData::__construct; the over-read buffer is the
5-byte estrndup'd alias.
Relevant source: ext/phar/zip.c:647 (mydata->alias_len =
entry.uncompressed_filesize), alias read at zip.c:660-700, memchr at
ext/phar/phar_internal.h:375.
Source assessment: alias_len trusts the archive-claimed size while the alias
buffer is allocated from the actual decompressed length
(php_stream_copy_to_mem at zip.c:662-698 updates entry.uncompressed_filesize
to the real length, but alias_len keeps the claimed value). The claimed
length then drives both the phar_validate_alias memchr and
Phar::getAlias()'s RETURN_STRINGL(alias, alias_len)
(ext/phar/phar_object.c:2640), which returns over-read heap bytes to PHP.
Expected: set alias_len from the actual decompressed length, or reject when
claimed and actual sizes differ.
Evidence: asan/PHAR-01-zip-alias-oob-read.asan.txt. PoC: poc/01-zip-alias-oob/
(make_zip.py patches the two size fields; poc.php only calls
new PharData('evil.zip')).

PHAR-01-zip-alias-oob-read.asan.txt

poc.php
make_zip.py

PHP Version

ext/phar — environment recorded for the attached observations

Component: ext/phar in php-src master, commit b9ea38ef639f5b9bbb67d27834be9c52b922520b (cloned 2026-10-21).
PHP: 8.7.0-dev (cli), NTS.
Platform: Linux x86-64 (Ubuntu 22.04 container, Docker).
Sanitizer: AddressSanitizer (-fsanitize=address -g -O1).
Configure: --disable-all --enable-cli --enable-phar --with-zlib --without-pcre-jit.

Recorded runtime environment:
  USE_ZEND_ALLOC=0
  ZEND_DONT_UNLOAD_MODULES=1
  ASAN_OPTIONS=abort_on_error=0:detect_leaks=0
  write-path tests additionally: php -d phar.readonly=0
  PHAR-05 runs under the CLI development server (php -S with a router script).

Operating System

No response