ext/phar: add upper-bound check on LongLink entry size

Author: crystarm

NEWS

@@ -81,6 +81,8 @@ PHP                                                                        NEWS
     PDOStatement::setFetchMode). (SakiTakamachi)
 
 - Phar:
+  . Fixed bug GH-22556 (OOM DoS via oversized ././@LongLink entry in TAR phar).
+    (crystarm)
   . Fixed bug GH-23418 (Use-after-free when looking up mounted directories).
     (Weilin Du)
   . Fixed bug GH-23477 (Memory leak on duplicate native Phar manifest entries).

ext/phar/tar.c

@@ -365,8 +365,9 @@ zend_result phar_parse_tarfile(php_stream* fp, char *fname, size_t fname_len, ch
 			/* support the ././@LongLink system for storing long filenames */
 			entry.filename_len = entry.uncompressed_filesize;
 
-			/* Check for overflow - bug 61065 */
-			if (entry.filename_len == UINT_MAX || entry.filename_len == 0) {
+			/* Check for empty or excessively large ././@LongLink filename entries - bug 61065 */
+			if (entry.filename_len == 0
+					|| entry.filename_len > UINT16_MAX) {
 				if (error) {
 					spprintf(error, 4096, "phar error: \"%s\" is a corrupted tar file (invalid entry size)", fname);
 				}