# Out of bound when verify signature of tar phar in phar_parse_tarfile

PHP's phar_parse_tarfile passed an attacker-controlled uncompressed_filesize minus 8 as signature length to phar_verify_signature, causing heap out-of-bounds read on a crafted tar phar.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: hoangnguyen
- Disclosed: 2019-11-12
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/167896
- Library page: https://bugbountylibrary.com/r/h1%3A167896
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:php technique:source-review vuln:memory-corruption

**Target:** PHP phar extension tar parser (phar_parse_tarfile)
**Root cause:** The tar phar signature length is computed as entry.uncompressed_filesize - 8 without validating that uncompressed_filesize >= 8, so a signature.bin smaller than 8 bytes underflows the length passed to phar_verify_signature.
**Steps:**
1. Craft a tar-based phar containing a signature.bin entry whose uncompressed_filesize is less than 8.
2. Load it with `new PharData('phars/signature.tar')`.
3. phar_parse_tarfile calls phar_verify_signature with sig_len = uncompressed_filesize - 8 (underflowed) and buffer sig + 8.
4. emalloc returns a 16-byte chunk for the small allocation, so the oversized length reads past the heap buffer.
**How found:** Code review of phar_parse_tarfile noticed the signature length was derived from entry.uncompressed_filesize minus 8 with no lower-bound check, then reasoned that a sub-8-byte signature.bin underflows the length and that emalloc's 16-byte minimum chunk makes the read go out of bounds.
**Exploitation:** Attacker supplies a malicious tar phar; parsing triggers an out-of-bounds heap read during signature verification, potentially crashing PHP or leaking adjacent heap memory.
**Insight:** When a length is computed as field - constant, check whether the field can be smaller than the constant; phar signature parsing is a rich source of such underflows because the signature length is attacker-controlled via the tar entry size.