# Out of bound when verify signature of zip phar in phar_parse_zipfile

PHP phar_parse_zipfile trusts attacker-controlled uncompressed_filesize for signature.bin, so a size <8 underflows sig_len and reads heap out of bounds.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: hoangnguyen
- Disclosed: 2019-11-12
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/167895
- Library page: https://bugbountylibrary.com/r/h1%3A167895
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:memory-corruption

**Target:** phar_parse_zipfile in PHP ext/phar
**Root cause:** The zip phar signature entry's uncompressed_filesize is used without validating it is >= 8; passing `entry.uncompressed_filesize - 8` as sig_len underflows, and `sig + 8` points past a 16-byte emalloc buffer.
**Steps:**
1. Craft a zip phar whose signature.bin entry has uncompressed_filesize less than 8.
2. Load it via `new PharData('phars/signature.zip')`.
3. phar_parse_zipfile emallocs entry.uncompressed_filesize (rounded to 16 bytes), reads it, then calls phar_verify_signature with sig_len = size-8 (underflow) and buffer sig+8.
4. phar_verify_signature reads out of bounds on the heap.
**How found:** Code review of phar_parse_zipfile: noticed no check that entry.uncompressed_filesize >= 8 before subtracting 8 for sig_len and offsetting sig by 8.
**Insight:** In phar/zip parsing, attacker-controlled uncompressed_filesize feeds both buffer allocation and length arithmetic; look for size-minus-header underflows where the header offset is added to the buffer pointer.