ext/phar: add upper-bound check on LongLink entry size (#24423)

Author: crystarm

NEWS

@@ -96,6 +96,10 @@ PHP                                                                        NEWS
   . Reverted the validity check on the flags argument of posix_access().
     (David Carlier)
 
+- Phar:
+  . Fixed bug GH-22556 (OOM DoS via oversized ././@LongLink entry in TAR phar).
+    (crystarm)
+
 - Readline:
   . Fixed a heap over-read in the interactive shell prompt when cli.prompt is
     set to an empty string. (Ilia Alshanetsky)

ext/phar/tar.c

@@ -441,8 +441,10 @@ zend_result phar_parse_tarfile(
 			last_was_longlink = true;
 			/* support the ././@LongLink system for storing long filenames */
 
-			/* Check for overflow - bug 61065 */
-			if (entry.uncompressed_filesize == 0 || entry.uncompressed_filesize > totalsize) {
+			/* Check for empty, truncated, or excessively large ././@LongLink filename entries - bug 61065 */
+			if (entry.uncompressed_filesize == 0
+					|| entry.uncompressed_filesize > totalsize
+					|| entry.uncompressed_filesize > UINT16_MAX) {
 				if (error) {
 					spprintf(error, 4096, "phar error: \"%s\" is a corrupted tar file (invalid entry size)", fname);
 				}